GitHub Advisoryadvisory · Go

GHSA-h4h6-vccr-44h2 uptrace pgdriver SQL injection vulnerability

MEDIUM Published 2025-06-12 Modified 2025-08-13 Official page ↗
Aliases
CVE-2024-44906
Ecosystem
Go
Packages
github.com/uptrace/bun/driver/pgdriver
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-89
Reviewed
2025-06-17

Affected packages

• Go github.com/uptrace/bun/driver/pgdriver: < 1.2.15 → fixed in 1.2.15

Description

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in `/pgdriver/format.go`. The maintainer has stated that the issue is fixed in v1.2.15.

Related

Alias · CVE (1)

  • CVE-2024-44906 uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References