Code injection in HackerOne pg node module
Priority MEDIUM 55CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.
Why it matters now
EPSS 0.1045 95th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed pg (npm): 2.11.2, 3.6.4, 4.5.7 +8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HackerOne | pg node module | < 2.11.2 || >= 3.0.0 < 3.6.4 || >= 4.0.0 < 4.5.7 || >= 5.0.0 < 5.2.1 || >= 6.0.0 < 6.0.5 || >= 6.1.0 < 6.1.6 || >= 6.2.0 < 6.2.5 || >= 6.3.0 < 6.3.3 || >= 6.4.0 < 6.4.2 || >= 7.0.0 < 7.0.2 || >= 7.1.0 < 7.1.2 | — | No fix listed | CNA |
| — | pg (npm) | before 2.11.2 | 2.11.2 | Patch available | GHSA-wc9v-mj63-m9g5 |
| — | pg (npm) | 3.0.0 to before 3.6.4 | 3.6.4 | Patch available | GHSA-wc9v-mj63-m9g5 |
| — | pg (npm) | 4.0.0 to before 4.5.7 | 4.5.7 | Patch available | GHSA-wc9v-mj63-m9g5 |
| — | pg (npm) | 5.0.0 to before 5.2.1 | 5.2.1 | Patch available | GHSA-wc9v-mj63-m9g5 |
| — | pg (npm) | 6.0.0 to before 6.0.5 | 6.0.5 | Patch available | GHSA-wc9v-mj63-m9g5 |
| — | pg (npm) | 6.1.0 to before 6.1.6 | 6.1.6 | Patch available | GHSA-wc9v-mj63-m9g5 |
| — | pg (npm) | 6.2.0 to before 6.2.5 | 6.2.5 | Patch available | GHSA-wc9v-mj63-m9g5 |
| — | pg (npm) | 6.3.0 to before 6.3.3 | 6.3.3 | Patch available | GHSA-wc9v-mj63-m9g5 |
| — | pg (npm) | 6.4.0 to before 6.4.2 | 6.4.2 | Patch available | GHSA-wc9v-mj63-m9g5 |
| — | pg (npm) | 7.0.0 to before 7.0.2 | 7.0.2 | Patch available | GHSA-wc9v-mj63-m9g5 |
| — | pg (npm) | 7.1.0 to before 7.1.2 | 7.1.2 | Patch available | GHSA-wc9v-mj63-m9g5 |
- pg node module VendorHackerOne Affected < 2.11.2 || >= 3.0.0 < 3.6.4 || >= 4.0.0 < 4.5.7 || >= 5.0.0 < 5.2.1 || >= 6.0.0 < 6.0.5 || >= 6.1.0 < 6.1.6 || >= 6.2.0 < 6.2.5 || >= 6.3.0 < 6.3.3 || >= 6.4.0 < 6.4.2 || >= 7.0.0 < 7.0.2 || >= 7.1.0 < 7.1.2 Fixed in — No fix listed CNA
- pg (npm) Vendor— Affected before 2.11.2 Fixed in 2.11.2 Patch available GHSA-wc9v-mj63-m9g5
- pg (npm) Vendor— Affected 3.0.0 to before 3.6.4 Fixed in 3.6.4 Patch available GHSA-wc9v-mj63-m9g5
- pg (npm) Vendor— Affected 4.0.0 to before 4.5.7 Fixed in 4.5.7 Patch available GHSA-wc9v-mj63-m9g5
- pg (npm) Vendor— Affected 5.0.0 to before 5.2.1 Fixed in 5.2.1 Patch available GHSA-wc9v-mj63-m9g5
- pg (npm) Vendor— Affected 6.0.0 to before 6.0.5 Fixed in 6.0.5 Patch available GHSA-wc9v-mj63-m9g5
- pg (npm) Vendor— Affected 6.1.0 to before 6.1.6 Fixed in 6.1.6 Patch available GHSA-wc9v-mj63-m9g5
- pg (npm) Vendor— Affected 6.2.0 to before 6.2.5 Fixed in 6.2.5 Patch available GHSA-wc9v-mj63-m9g5
- pg (npm) Vendor— Affected 6.3.0 to before 6.3.3 Fixed in 6.3.3 Patch available GHSA-wc9v-mj63-m9g5
- pg (npm) Vendor— Affected 6.4.0 to before 6.4.2 Fixed in 6.4.2 Patch available GHSA-wc9v-mj63-m9g5
- pg (npm) Vendor— Affected 7.0.0 to before 7.0.2 Fixed in 7.0.2 Patch available GHSA-wc9v-mj63-m9g5
- pg (npm) Vendor— Affected 7.1.0 to before 7.1.2 Fixed in 7.1.2 Patch available GHSA-wc9v-mj63-m9g5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:node-postgres:pg:*:*:*:*:*:node.js:*:* | 2.0.0 to before 2.11.2; 3.0.0 to before 3.6.4; 4.0.0 to before 4.5.7; after 5.0.0, before 5.2.1; 6.0.0 to before 6.4.2; 7.0.0 to before 7.1.2 | Vulnerable | Node-postgres |
- cpe:2.3:a:node-postgres:pg:*:*:*:*:*:node.js:*:* Versions 2.0.0 to before 2.11.2; 3.0.0 to before 3.6.4; 4.0.0 to before 4.5.7; after 5.0.0, before 5.2.1; 6.0.0 to before 6.4.2; 7.0.0 to before 7.1.2 Vulnerable ·Node-postgres
Remediation
- Fix · GHSA-wc9v-mj63-m9g5 pg (npm) Fixed in 2.11.2 Advisory →
- Fix · GHSA-wc9v-mj63-m9g5 pg (npm) Fixed in 3.6.4 Advisory →
- Fix · GHSA-wc9v-mj63-m9g5 pg (npm) Fixed in 4.5.7 Advisory →
- Fix · GHSA-wc9v-mj63-m9g5 pg (npm) Fixed in 5.2.1 Advisory →
- Fix · GHSA-wc9v-mj63-m9g5 pg (npm) Fixed in 6.0.5 Advisory →
- Fix · GHSA-wc9v-mj63-m9g5 pg (npm) Fixed in 6.1.6 Advisory →
- Fix · GHSA-wc9v-mj63-m9g5 pg (npm) Fixed in 6.2.5 Advisory →
- Fix · GHSA-wc9v-mj63-m9g5 pg (npm) Fixed in 6.3.3 Advisory →
- Fix · GHSA-wc9v-mj63-m9g5 pg (npm) Fixed in 6.4.2 Advisory →
- Fix · GHSA-wc9v-mj63-m9g5 pg (npm) Fixed in 7.0.2 Advisory →
- Fix · GHSA-wc9v-mj63-m9g5 pg (npm) Fixed in 7.1.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-16082
- 2026-10-03 Alias added: GHSA-wc9v-mj63-m9g5
References
Sources
- CVE-2017-16082 · CVE Program
- CVE-2017-16082 · NVD
- FIRST EPSS
- GHSA-wc9v-mj63-m9g5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences