Read the docs
TI-2022-16369 Aliases CVE-2022-35942GHSA-j259-6c58-9m58

loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter

Priority MEDIUM 44CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to be interpreted by the Postgres connector, it is possible to inject arbitrary SQL which may affect the confidentiality and integrity of data stored on the connected database. A patch was released in version 5.5.1. This affects users who does any of the following: - Connect to the database via the DataSource with `allowExtendedProperties: true` setting OR - Uses the connector's CRUD methods directly OR - Uses the connector's other methods to interpret the LoopBack filter. Users who are unable to upgrade should do the following if applicable: - Remove `allowExtendedProperties: true` DataSource setting - Add `allowExtendedProperties: false` DataSource setting - When passing directly to the connector functions, manually sanitize the user input for the `contains` LoopBack filter beforehand.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00656 51st percentileScored 2026-11-07
Fix Fixed loopback-connector-postgresql (loopbackio): 5.5.1loopback-connector-postgresql (npm): 5.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
loopbackioloopback-connector-postgresqlbefore 5.5.15.5.1Patch availableCNA
—loopback-connector-postgresql (npm)before 5.5.15.5.1Patch availableGHSA-j259-6c58-9m58
  • loopback-connector-postgresql Vendorloopbackio Affected before 5.5.1 Fixed in 5.5.1 Patch available CNA
  • loopback-connector-postgresql (npm) Vendor— Affected before 5.5.1 Fixed in 5.5.1 Patch available GHSA-j259-6c58-9m58

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:loopback-connector-postgresql:*:*:*:*:*:node.js:*:*before 5.5.1Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:loopback-connector-postgresql:*:*:*:*:*:node.js:*:* Versions before 5.5.1 Vulnerable ·backstage

Remediation

  • Fix · CNA loopback-connector-postgresql (loopbackio) Fixed in 5.5.1
  • Fix · GHSA-j259-6c58-9m58 loopback-connector-postgresql (npm) Fixed in 5.5.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-35942
  2. 2026-10-03 Alias added: GHSA-j259-6c58-9m58
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences