Skip to content
Fencer Vulns
critical 9.8

CVE-2017-16082 in the critical feed json

Remote Code Execution in pg

published 2018-06-07 8 y ago modified 2026-06-17 4 mo ago also GHSA-wc9v-mj63-m9g5 , EUVD-2018-0331

cvss
9.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
10.4%
EPSS 10.4% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.

Patch / fix

  • npm pg 2.11.2, 3.6.4, 4.5.7, 5.2.1, 6.0.5, 6.1.6, 6.2.5, 6.3.3, 6.4.2, 7.0.2, 7.1.2
  • node-postgres pg 2.11.2, 3.6.4, 4.5.7, 5.2.1, 6.4.2, 7.1.2
  • node-postgres Debian 14, Debian 13, Debian 12 7.7.1-1

debian advisories DEBIAN-CVE-2017-16082

Exploit prediction

10.45% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • node-postgres.com https://node-postgres.com/announcements#2017-08-12-code-execution-vulnerability referenced PoC, tagged "exploit" by a source, unverified
  • nodesecurity.io https://nodesecurity.io/advisories/521 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm pg
<2.11.2
>=3.0.0, <3.6.4
>=4.0.0, <4.5.7
>=5.0.0, <5.2.1
>=6.0.0, <6.0.5
>=6.1.0, <6.1.6
>=6.2.0, <6.2.5
>=6.3.0, <6.3.3
>=6.4.0, <6.4.2
>=7.0.0, <7.0.2
>=7.1.0, <7.1.2
2.11.2
3.6.4
4.5.7
5.2.1
6.0.5
6.1.6
6.2.5
6.3.3
6.4.2
7.0.2
7.1.2

Affected products

  • HackerOne pg node module

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.