5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-29744

CVE-2025-29744: pg-promise SQL Injection vulnerability

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-29744

CVE-2025-29744:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pg-promise	npm	< 11.5.5	11.5.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-29744, exists in the pg-promise library prior to version 11.5.5. It's an SQL injection flaw caused by the improper formatting of negative numbers.

The root cause is within the number function located in lib/formatting.js. When the library operates in 'simple query mode' (where it constructs SQL strings by interpolating parameters, rather than using the database's native prepared statement mechanism), it processes numeric parameters through this function.

Before the patch, if a query was structured like SELECT * FROM table WHERE value = -$1; and the parameter $1 was a negative number (e.g., -10), the number function would convert -10 to the string "-10". When this string was inserted into the query, it would become SELECT * FROM table WHERE value = --10;. In SQL, -- signifies the beginning of a line comment. This effectively changes the query to SELECT * FROM table WHERE value = (with 10; being commented out), which would likely cause a syntax error.

However, if an attacker could control a subsequent parameter on the same line, they could exploit this. For example, in a query like SELECT * FROM table WHERE value = -$1 OR name = $2;, if $1 is -10 and $2 is a malicious string like "'foo'\n UNION SELECT credit_card FROM user_data; --", the interpolated query would become SELECT * FROM table WHERE value = --10 OR name = 'foo'\n UNION SELECT credit_card FROM user_data; --';. The database would interpret this as SELECT * FROM table WHERE value = (due to the comment) followed by the injected SQL after the newline character in the string literal for $2.

The patch, as detailed in the SonarSource blog and the GitHub discussion, modifies the number function to wrap negative numbers in parentheses. So, -10 becomes "(-10)". The example query SELECT * FROM table WHERE value = -$1; would then become SELECT * FROM table WHERE value = -(-10);, which is valid SQL and prevents the formation of the -- comment, thus mitigating the SQL injection vulnerability. The primary vulnerable function is therefore number in lib/formatting.js as it's directly responsible for the unsafe formatting of negative numbers.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.