SQL Injection

Overview

Versions of connect-pg-simple are vulnerable to SQL Injection. The PGStore.prototype.quotedTable function allows for the query to be manipulated if the input has double quotes through the schemaName or tableName variables. These variables are passed to the constructor and are unlikely to be controlled by user-input. If they are controlled by user-input it could allow attackers to execute arbitrary SQL queries.

Recommendation

Upgrade to version 6.0.1 or later.

References

• GitHub Security Advisory
• Snyk Report
• GitHub Advisory