CVE-2017-16082

CVE-2017-16082

Vendor Hackerone
Product pg node module
Weakness CWE-94 · Code injection
Published June 7, 2018
Last update September 17, 2024

CVSS base score

What the vulnerability does

01Description

A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.

Key dates

02Disclosure timeline

June 7, 2018 CVE published
September 17, 2024 Record updated