{"action":"Upgrade pg-promise to 11.5.5 or later.","affected":[{"fixed":"11.5.5","introduced":"0"}],"component":"pg-promise","cve_ids":["CVE-2025-29744"],"ecosystem":"npm","epss":0.00221,"exploited":false,"fixed_versions":["11.5.5"],"ghsa_id":"GHSA-ff9h-848c-4xfj","id":"tcs_01M5KFNB6HJVHFQCFCWE1TSVJX","modified_at":"2025-06-18T20:29:43.786084Z","published_at":"2025-06-12T18:31:48Z","references":["https://osv.dev/vulnerability/GHSA-ff9h-848c-4xfj","https://nvd.nist.gov/vuln/detail/CVE-2025-29744","https://github.com/vitaly-t/pg-promise","https://github.com/vitaly-t/pg-promise/discussions/911","https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-ff9h-848c-4xfj","url":"https://osv.dev/vulnerability/GHSA-ff9h-848c-4xfj"}],"summary":"pg-promise SQL Injection vulnerability"}