AIKIDO-2026-632795
@agendajs/postgres-backend is vulnerable to SQL Injection
64
Medium Risk
This Affects:
@agendajs/postgres-backendTL;DR
The PostgreSQL backend for agenda builds the uniqueness lookup that drives job upserts by concatenating unique() constraint keys directly into the SQL statement, while only the values are bound as parameters. A key such as data.id' OR '1'='1 rewrites the WHERE clause of the existence check, and because the follow-up UPDATE has no row limit it can overwrite every job's data and next run time and force them to run immediately. Exploitation requires the consuming application to build uniqueness keys from untrusted input. The fix binds JSON paths as query parameters and validates column names against the table's real columns.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application builds unique() constraint keys from untrusted input.
Background info
@agendajs/postgres-backend is vulnerable to SQL Injection in versions 1.0.0 - 3.0.5.
How to fix this
Upgrade the @agendajs/postgres-backend library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant