-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe security patches add array validation checks to multiple query execution methods in index.js. The vulnerable versions lacked these checks, allowing non-array parameters to trigger failed casting attempts. The added assertions in execParams, execPrepared, sendQueryParams, and sendQueryPrepared directly correlate to the CWE-400/CWE-704 vulnerabilities described. Test cases in async-socket.js and sync-parameters.js verify that non-array parameters now throw errors, confirming these were the entry points for the vulnerability. These functions would appear in runtime profiles when handling malicious parameter inputs.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| libpq | npm | <= 1.8.9 | 1.8.10 |
| pg-native | npm | <= 3.0.0 | 3.0.1 |
Ongoing coverage of React2Shell