CVE-2017-16082

CRITICAL

A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.

Published: Jun 7, 2018 Modified: Jun 17, 2026

CWE-94 CWE-94

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (6)

Vendor	Product	Version
node-postgres	pg	* ≥ 2.0.0 < 2.11.2
node-postgres	pg	* ≥ 3.0.0 < 3.6.4
node-postgres	pg	* ≥ 4.0.0 < 4.5.7
node-postgres	pg	* < 5.2.1
node-postgres	pg	* ≥ 6.0.0 < 6.4.2
node-postgres	pg	* ≥ 7.0.0 < 7.1.2

GitHub Security Advisory GHSA-wc9v-mj63-m9g5

Remote Code Execution in pg

npm pg < 2.11.2 Fixed: 2.11.2

npm pg >= 3.0.0, < 3.6.4 Fixed: 3.6.4

npm pg >= 4.0.0, < 4.5.7 Fixed: 4.5.7

npm pg >= 5.0.0, < 5.2.1 Fixed: 5.2.1

npm pg >= 6.0.0, < 6.0.5 Fixed: 6.0.5

npm pg >= 6.1.0, < 6.1.6 Fixed: 6.1.6

npm pg >= 6.2.0, < 6.2.5 Fixed: 6.2.5

npm pg >= 6.3.0, < 6.3.3 Fixed: 6.3.3

npm pg >= 6.4.0, < 6.4.2 Fixed: 6.4.2

npm pg >= 7.0.0, < 7.0.2 Fixed: 7.0.2

npm pg >= 7.1.0, < 7.1.2 Fixed: 7.1.2

References (4)

https://node-postgres.com/announcements#2017-08-12-code-execution-vulnerability Exploit, Third Party Advisory
https://nodesecurity.io/advisories/521 Exploit, Third Party Advisory
https://node-postgres.com/announcements#2017-08-12-code-execution-vulnerability Exploit, Third Party Advisory
https://nodesecurity.io/advisories/521 Exploit, Third Party Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 10.51%

Top 5% most likely to be exploited

Threat Score 42.4 / 100

Data Sources

NVD EPSS GitHub