~ / search / GHSA-ff9h-848c-4xfj

GHSA-ff9h-848c-4xfj

pg-promise SQL Injection vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-29744

Packages

EcosystemPackageAffectedFixed in
npm pg-promise < 11.5.5 11.5.5

Details

As written in the advisory (Markdown source, shown as plain text).

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.

References

External links from the advisory. They lead to third-party sites.