CVE-2025-29744

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...

@emuanalytics/flow-pipelines (>=0.0.1, <=1.3.9), @evdhiggins/airtable-sync (0.2.6) +10 more potentially affected by CVE-2025-29744 via pg-promise (>=11.0.0, <=11.5.4)

pg-promise NPM version =11.0.0, =0.0.1, =1.0.1, =1.2.1, =6.1.0-alpha.7, =2.4.46, =1.0.1, =0.29.0, =6.1.0-alpha.3, =2.0.0, =2.0.1 Source cves: CVE-2025-29744 Source advisory: OSV:GHSA-FF9H-848C-4XFJ...

CVE-2025-29744

creationtimestamp| type| source ---|---|--- 2025-06-12 17:26:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrggybhfun2e 2025-06-17 19:39:31+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18655...

CVE-2025-29744

CVE-2025-29744 affects pg-promise (Node.js PostgreSQL interface); root cause is improper handling of negative numbers, leading to SQL Injection in versions before 11.5.5. Public documents consistently describe a vulnerability in the query construction/parameter handling that can allow attacker-su...