medium5.4
CVE-2025-29744
pg-promise SQL Injection vulnerability
Impact
pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | pg-promise | < 11.5.5 | 11.5.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vitaly-T | Pg-Promise | before 11.5.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/vitaly-t/pg-promise/discussions/911
- https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/
- https://github.com/advisories/GHSA-ff9h-848c-4xfj
- https://nvd.nist.gov/vuln/detail/CVE-2025-29744
- https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw