@emartech/me-psql-query-builder (>=1.0.0, <=1.1.0), @evocodes/parse-server (>=2.2.17, <=2.2.27) +48 more potentially affected by CVE-2017-16082 via pg (>=5.0.0, <=5.1.0)

pg NPM version =5.0.0, =1.0.0, =2.2.17, =0.9.28, =1.0.0, =0.4.0, =0.1.0, =0.0.2, =0.1.3, =0.2.30, =0.2.33 and more Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

@launchql/cli (>=0.3.34, <=0.4.44), @launchql/db-testing (>=0.0.9, <=0.1.8) +8 more potentially affected by CVE-2017-16082 via pg (>=6.4.0, <=6.4.1)

pg NPM version =6.4.0, =0.3.34, =0.0.9, =0.0.4, =1.0.0, =0.6.22, =0.6.12, =1.0.31, =1.0.61 Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

@folk-org/js-dav (>=1.0.0, <=1.0.3), @lettercms/models (>=0.0.1, <=0.0.12) +187 more potentially affected by CVE-2017-16082 via pg (>=4.0.0, <=4.5.6)

pg NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.15 and more Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

@yihangho/express-admin (1.3.2-2), analyst (>=0.0.3, <=0.0.8) +58 more potentially affected by CVE-2017-16082 via pg (>=2.0.0, <=2.11.1)

pg NPM version =2.0.0, =0.0.3, =0.1.0, =0.0.1, =0.0.62, =0.0.1, =0.0.1, =1.0.1, =0.0.1, =0.1.0, =0.0.1, =0.0.3 and more Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

@starboard/models (>=2.0.0, <=3.0.1), @starboard/shared-backend (3.0.0) +24 more potentially affected by CVE-2017-16082 via pg (>=6.0.0, <=6.0.4)

pg NPM version =6.0.0, =2.0.0, =0.6.0, =0.0.1, =1.0.0, =0.2.0, =0.1.0, =2.0.2, =1.3.1, =0.0.4, =0.1.0, =0.2.0, =0.6.0 and more Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

@arpinum/postgres (>=4.0.0-beta12, <=4.0.0-beta14), appointmed-epr-template-common (>=0.0.46, <=0.0.65) +9 more potentially affected by CVE-2017-16082 via pg (>=6.2.2, <=6.2.3)

pg NPM version =6.2.2, =4.0.0-beta12, =0.0.46, =0.0.35, =0.13.3, =0.0.1, =0.0.1, =1.0.0, =1.0.3 - pg-promise-strict 0.3.4 - pgo 0.2.1 Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

@keyv/postgres (>=1.0.7, <=1.0.9), keyv-postgres (>=1.0.5, <=1.0.6) +2 more potentially affected by CVE-2017-16082 via pg (>=7.1.0, <=7.1.1)

pg NPM version =7.1.0, =1.0.7, =1.0.5, =0.0.1, =0.0.3 Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

acidjs (>=0.0.2, <=1.0.1), acl-knex (>=0.1.2, <=0.1.3) +41 more potentially affected by CVE-2017-16082 via pg (>=3.0.3, <=3.6.3)

pg NPM version =3.0.3, =0.0.2, =0.1.2, =0.0.1, =0.0.2, =0.1.0, =0.0.4, =0.3.0, =0.0.11, =0.0.12, =0.1.2, =0.0.2, =0.0.1, =0.0.64 and more Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

@aliens-lyon.fr/ep_mypads (1.7.24), @arpinum/postgres (>=1.0.0-beta, <=4.0.0-beta9) +56 more potentially affected by CVE-2017-16082 via pg (>=6.1.0, <=6.1.5)

pg NPM version =6.1.0, =1.0.0-beta, =1.0.2, =0.0.1, =0.0.23, =0.1.1, =0.1.1, =0.0.2, =0.0.9, =1.6.5, =0.2.7, =1.0.2, =1.0.3 and more Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

CVE-2017-16082

CVE-2017-16082 is a remote code execution vulnerability in the pg module that triggers when the remote database or query returns a crafted column name. The provided connected documents show two vulnerable scenarios: (1) unsafe, user-supplied SQL containing a malicious column name, and (2) queryin...