CVE-2026-4190 in node-api-postgres
Summary
by MITRE • 03/16/2026
A vulnerability was detected in JawherKl node-api-postgres up to 2.5. This impacts the function User.getAll of the file models/user.js. The manipulation of the argument sort results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 05/28/2026
The vulnerability identified in JawherKl node-api-postgres version 2.5 represents a critical sql injection flaw within the User.getAll function of the models/user.js file. This security weakness arises from improper handling of the sort argument parameter, which allows malicious actors to manipulate database queries through crafted input. The vulnerability exists in the application's data access layer where user-provided sorting parameters are directly incorporated into sql statements without adequate sanitization or parameterization. The remote exploitability of this flaw means that attackers can execute malicious sql commands from external positions without requiring local system access or authentication. Given that the exploit is publicly available and actively being used, organizations running this specific version of the node-api-postgres library face immediate security risk.
The technical implementation of this vulnerability demonstrates a classic sql injection attack vector where the sort parameter serves as the entry point for database manipulation. When user input is concatenated directly into sql queries rather than being properly parameterized, attackers can inject malicious sql fragments that alter the intended query behavior. This flaw aligns with CWE-89, which specifically addresses sql injection vulnerabilities in software applications. The attack surface is particularly concerning because it operates at the database interaction level, potentially allowing for data exfiltration, unauthorized data modification, or complete database compromise. The vulnerability's presence in the User.getAll function suggests that any application utilizing this library for user management operations is exposed to this risk.
The operational impact of this vulnerability extends beyond immediate data security concerns to encompass potential business disruption and regulatory compliance violations. Organizations may face unauthorized access to sensitive user data, including personal information, authentication credentials, or other confidential records stored in the postgres database. The remote execution capability eliminates the need for physical access or insider threat vectors, making the attack surface more expansive and the threat more persistent. Security teams must consider that this vulnerability could enable advanced persistent threats where attackers establish long-term access to database resources. The lack of vendor response to early disclosure attempts compounds the risk, as organizations cannot rely on official patches or updates to address the flaw. This scenario represents a critical gap in the security supply chain where vulnerable components remain unpatched and unsupported.
Organizations must implement immediate mitigations while seeking alternative solutions to address this vulnerability. The most effective immediate measure involves implementing proper input validation and parameterized query construction for all database interactions, particularly within the User.getAll function. Application firewalls or web application firewalls should be configured to monitor for sql injection patterns in sort parameter values. Database access controls should be reviewed to ensure least privilege principles are enforced, limiting potential damage from successful exploitation. Additionally, organizations should consider implementing database activity monitoring and anomaly detection systems to identify suspicious sql query patterns. The remediation process should include upgrading to a patched version of the node-api-postgres library when available, though the vendor's lack of response creates urgency for alternative approaches. Security teams must also conduct comprehensive code reviews to identify similar patterns in other database interaction points within the application stack. This vulnerability demonstrates the importance of secure coding practices and the necessity of regular security assessments to identify and remediate such critical flaws before they can be exploited in the wild.