CVE-2025-29744

Description

pg-promise before 11.5.5 is vulnerable to SQL Injection due to improper handling of negative numbers.

Affected Platforms

Weakness Type

CWE-89

References

• https://github.com/vitaly-t/pg-promise/discussions/911
• https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injecti…