GHSA-xqh8-5j36-4556

Source

https://github.com/advisories/GHSA-xqh8-5j36-4556

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/08/GHSA-xqh8-5j36-4556/GHSA-xqh8-5j36-4556.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xqh8-5j36-4556

Aliases

CVE-2019-15658

Published

2019-08-26T16:59:45Z

Modified

2026-07-08T06:00:19Z

Severity

7.3 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

SQL Injection in connect-pg-simple

Details

Impact

An unlikely SQL injection if the case of an unsanitized table name input.

Patches

The user should upgrade to 6.0.1. Due to its low impact a backport has not been made to the 5.x branch.

Workarounds

If there is no likelihood that the tableName or schemaName options sent to the constructor could be of an unsanitized nature, then no workaround is needed. Else the input could be sanitized and escaped before sending it in. Take note though that such an escaping would need to be removed when upgrading to 6.0.1 or later, to avoid double escaping.

References

Security issue disclosure

For more information

If you have any questions or comments about this advisory:

Open an issue in voxpelli/node-connect-pg-simple
Email maintainer at pelle@kodfabrik.se

Database specific

{
    "cwe_ids":  [
        "CWE-89"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T22:04:11Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / connect-pg-simple

Package

Name: connect-pg-simple; View open source insights on deps.dev
Purl: pkg:npm/connect-pg-simple

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

6.0.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/08/GHSA-xqh8-5j36-4556/GHSA-xqh8-5j36-4556.json"