pg-promise SQL Injection vulnerability

MEDIO 5.4CVE-2025-29744 · GHSA-ff9h-848c-4xfj · Published 12/06/2025 · updated 17/06/2026

In breve

CVE-2025-29744 è una vulnerabilità MEDIO (CVSS 5.4) che riguarda pg-promise (vitaly-t), pg-promise.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.23%, superiore al 13.9% delle vulnerabilità.
Correzione: aggiornare a 11.5.5 o successiva.

Package	Affected versions	Patched versions
pg-promise vitaly-t	`< 11.5.5`	`11.5.5`
pg-promise npm	`< 11.5.5`	`11.5.5`

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.

NVD description

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.