AIKIDO-2025-10850
github.com/uptrace/bun/driver/pgdriver is vulnerable to SQL Injection
30
Low Risk
This Affects:
github.com/uptrace/bun/driver/pgdriverTL;DR
Affected versions of this package could be vulnerable to SQL injection when PostgreSQL’s standard_conforming_strings is explicitly set to off, a legacy configuration that modern deployments rarely use. Because this setting has defaulted to on for over a decade, the practical impact is minimal. The fix enforces standard_conforming_strings=on and client_encoding=UTF8 to ensure safe string-literal handling, though testing these conditions is difficult without legacy or deliberately misconfigured PostgreSQL instances.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you explicitly set standard_conforming_strings=off.
Background info
github.com/uptrace/bun/driver/pgdriver is vulnerable to SQL Injection in versions 0.1.0 - 1.2.15.
How to fix this
Upgrade the github.com/uptrace/bun/driver/pgdriver library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant