{"id":"GHSA-8wj8-cfxr-9374","aliases":[],"status":"published","title":"AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance","description":"### Description of Vulnerability: \nAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.\n\nAWS recommends that customers upgrade to the following version:  AWS NodeJS Wrapper to v2.0.1.\n\n\n### Source of Vulnerability Report:\nAllistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)\n\n\n### Affected products \u0026 versions: \nAWS NodeJS Wrapper \u003c 2.0.1.\n\n\n### Platforms: \nMacOS/Windows/Linux","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-470"],"published":"2025-11-13T22:22:37Z","modified":"2026-02-04T02:37:03Z","fixes":[{"ecosystem":"npm","package":"aws-advanced-nodejs-wrapper","fixed_in":["2.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"aws-advanced-nodejs-wrapper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"aws-advanced-nodejs-wrapper","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.1"}]}]}],"references":[{"url":"https://github.com/aws/aws-advanced-nodejs-wrapper/security/advisories/GHSA-8wj8-cfxr-9374","tags":["web"]},{"url":"https://github.com/aws/aws-advanced-nodejs-wrapper/pull/574","tags":["web"]},{"url":"https://github.com/aws/aws-advanced-nodejs-wrapper/releases/tag/2.0.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8wj8-cfxr-9374"},{"url":"https://github.com/aws/aws-advanced-nodejs-wrapper","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-8wj8-cfxr-9374","title":"AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance","description":"### Description of Vulnerability: \nAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.\n\nAWS recommends that customers upgrade to the following version:  AWS NodeJS Wrapper to v2.0.1.\n\n\n### Source of Vulnerability Report:\nAllistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)\n\n\n### Affected products \u0026 versions: \nAWS NodeJS Wrapper \u003c 2.0.1.\n\n\n### Platforms: \nMacOS/Windows/Linux","status":"published","published":"2025-11-13T22:22:37Z","modified":"2025-11-13T22:22:40Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T14:39:08.983925Z"}],"osv":[{"id":"GHSA-8wj8-cfxr-9374","title":"AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance","description":"### Description of Vulnerability: \nAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.\n\nAWS recommends that customers upgrade to the following version:  AWS NodeJS Wrapper to v2.0.1.\n\n\n### Source of Vulnerability Report:\nAllistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)\n\n\n### Affected products \u0026 versions: \nAWS NodeJS Wrapper \u003c 2.0.1.\n\n\n### Platforms: \nMacOS/Windows/Linux","status":"published","published":"2025-11-13T22:22:37Z","modified":"2026-02-04T02:37:03.636228Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-470"],"updated_at":"2026-11-02T15:46:42.78452Z"}]}}