CVE-2025-29744

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers...

@emuanalytics/flow-pipelines (>=0.0.1, <=1.4.2), @evdhiggins/airtable-sync (0.2.6) +10 more potentially affected by CVE-2025-29744 via pg-promise (>=11.0.0, <=11.5.4)

pg-promise NPM version =11.0.0, =0.0.1, =1.0.1, =1.2.1, =6.1.0-alpha.7, =2.4.46, =1.0.1, =0.29.0, =6.1.0-alpha.3, =2.0.0, =2.0.1 Source cves: CVE-2025-29744 Source advisory: OSV:GHSA-FF9H-848C-4XFJ...

CVE-2025-29744

creationtimestamp| type| source ---|---|--- 2025-06-12 17:26:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrggybhfun2e 2025-06-17 19:39:31+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18655...

CVE-2025-29744

The pg-promise library (NPM) versions prior to 11.5.5 are vulnerable to SQL Injection due to the improper handling of negative numbers. This flaw allows an attacker to manipulate SQL queries by injecting malicious input. Several packages, including parse-server , class-controller , and @evdhiggin...