CVE-2017-16082: Remote Code Execution in pg

pg Updated 02 Oct 2025

Summary

24/07/2018

Disclosed on

CVE-2017-16082

CVE

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

CVE-2017-16082: Remote Code Execution in pg. Affects pg across 11 version ranges.

< 2.11.2 >= 3.0.0, < 3.6.4 >= 4.0.0, < 4.5.7 >= 5.0.0, < 5.2.1 >= 6.0.0, < 6.0.5 >= 6.1.0, < 6.1.6 >= 6.2.0, < 6.2.5 >= 6.3.0, < 6.3.3 >= 6.4.0, < 6.4.2 >= 7.0.0, < 7.0.2 >= 7.1.0, < 7.1.2

Fixed in 11 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Also tracked for

node-postgres · Debian:11

The same CVE-2017-16082 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The pg package is an open-source library for connecting to PostgreSQL databases from Node.js applications. It provides a simple and efficient way to interact with PostgreSQL databases, allowing developers to execute SQL queries and manage database connections. However, certain versions of the pg package are vulnerable to remote code execution.

Vulnerability Detail

The vulnerability in the pg package allows for remote code execution when the remote database or query specifies a crafted column name. This vulnerability can be exploited in two scenarios: 1) when the application executes unsafe, user-supplied SQL that contains malicious column names, and 2) when the application connects to an untrusted database and executes a query returning results that contain a malicious column name. An attacker can exploit this vulnerability to execute arbitrary code on the server hosting the PostgreSQL database, potentially leading to unauthorized access, data leakage, or other malicious activities.

How To Fix

Latest published version: 8.23.1 as of 22 Oct 2026

npm install pg@8.23.1

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 2.11.2 2.11.2
```
npm install pg@2.11.2
```
>= 3.0.0, < 3.6.4 3.6.4
```
npm install pg@3.6.4
```
>= 4.0.0, < 4.5.7 4.5.7
```
npm install pg@4.5.7
```
>= 5.0.0, < 5.2.1 5.2.1
```
npm install pg@5.2.1
```
>= 6.0.0, < 6.0.5 6.0.5
```
npm install pg@6.0.5
```
>= 6.1.0, < 6.1.6 6.1.6
```
npm install pg@6.1.6
```

Show all 11 release lines

>= 6.2.0, < 6.2.5 6.2.5
```
npm install pg@6.2.5
```
>= 6.3.0, < 6.3.3 6.3.3
```
npm install pg@6.3.3
```
>= 6.4.0, < 6.4.2 6.4.2
```
npm install pg@6.4.2
```
>= 7.0.0, < 7.0.2 7.0.2
```
npm install pg@7.0.2
```
>= 7.1.0, < 7.1.2 7.1.2
```
npm install pg@7.1.2
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no known workaround for this vulnerability. It is crucial to update the pg package to the latest patched version as soon as possible.

Conclusion

The pg package is vulnerable to remote code execution when the remote database or query specifies a crafted column name. This vulnerability can be exploited to execute arbitrary code on the server hosting the PostgreSQL database, potentially leading to unauthorized access, data leakage, or other malicious activities. It is crucial to update the pg package to the latest patched version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for pg →

FAQ

What is the impact of this vulnerability?

This vulnerability allows an attacker to execute arbitrary code on the server hosting the PostgreSQL database, potentially leading to unauthorized access, data leakage, or other malicious activities.

How can I check if my application is affected by this vulnerability?

You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.

Can this vulnerability be exploited remotely?

Yes, this vulnerability can be exploited remotely if the application connects to an untrusted database and executes a query returning results that contain a malicious column name.

Are there any known instances of this vulnerability being exploited in the wild?

There are no known instances of this vulnerability being exploited in the wild at this time.

Is there a fix available for this vulnerability?

Yes, the pg package maintainers have released patched versions to address this vulnerability. It is recommended to update to the latest version as soon as possible.

References