CVE-2019-15658
SQL Injection in connect-pg-simple
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.
- Record
CVE-2019-15658- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.
- Record
CVE-2019-15658- Updated
- 2026-11-02
EUVDEUVD-2019-0645 No score
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.
- Record
EUVD-2019-0645- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xqh8-5j36-4556
SQL Injection in connect-pg-simple
Impact
An unlikely SQL injection if the case of an unsanitized table name input.
Patches
The user should upgrade to 6.0.1. Due to its low impact a backport has not been made to the 5.x branch.
Workarounds
If there is no likelihood that the tableName or schemaName options sent to the constructor could be of an unsanitized nature, then no workaround is needed. Else the input could be sanitized and escaped before sending it in. Take note though that such an escaping would need to be removed when upgrading to 6.0.1 or later, to avoid double escaping.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in voxpelli/node-connect-pg-simple
- Email maintainer at [email protected]
- Record
GHSA-xqh8-5j36-4556- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
connect-pg-simple before 6.0.1 allows SQL injection if tableName or schemaName is untrusted data.
- Record
CVE-2019-15658- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-xqh8-5j36-4556
SQL Injection in connect-pg-simple
Impact
An unlikely SQL injection if the case of an unsanitized table name input.
Patches
The user should upgrade to 6.0.1. Due to its low impact a backport has not been made to the 5.x branch.
Workarounds
If there is no likelihood that the tableName or schemaName options sent to the constructor could be of an unsanitized nature, then no workaround is needed. Else the input could be sanitized and escaped before sending it in. Take note though that such an escaping would need to be removed when upgrading to 6.0.1 or later, to avoid double escaping.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in voxpelli/node-connect-pg-simple
- Email maintainer at [email protected]
- Record
GHSA-xqh8-5j36-4556- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
connect-pg-simplenpm |
before 6.0.1 | 6.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-15658 is a high vulnerability (CVSS 7.3) in Connect-pg-simple Project Connect-pg-simple, published August 26, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in connect-pg-simple 6.0.1.