Description
pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | pg-promise | < 11.5.5 | 11.5.5 | GHSA-ff9h-848c-4xfj |
Medium · 5.4
CVE-2025-29744
EUVD-2025-18190GHSA-ff9h-848c-4xfj
pg-promise SQL Injection vulnerability
Published Jun 12, 2025 · Updated Jun 17, 2025 · Assigned by mitre