Read the docs
TI-2025-36208 Aliases CVE-2025-58450GHSA-p46v-f2x8-qp98

pREST has Systemic SQL Injection Vulnerability

Priority HIGH 81CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database. SQL injection is possible in versions prior to 2.0.0-rc3. The validation present in versions prior to 2.0.0-rc3 does not provide adequate protection from injection attempts. Version 2.0.0-rc3 contains a patch to mitigate such attempts.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00442 38th percentileScored 2026-11-07
Fix Fixed prest (prest): 2.0.0-rc3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
prestprestbefore 2.0.0-rc32.0.0-rc3Patch availableCNA
—github.com/prest/prest/v2 (Go)all versions—No fix listedGHSA-p46v-f2x8-qp98
  • prest Vendorprest Affected before 2.0.0-rc3 Fixed in 2.0.0-rc3 Patch available CNA
  • github.com/prest/prest/v2 (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-p46v-f2x8-qp98

Remediation

  • Fix · CNA prest (prest) Fixed in 2.0.0-rc3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58450
  2. 2026-10-03 Alias added: GHSA-p46v-f2x8-qp98

References

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences