GO-2025-3765
- Source
- https://pkg.go.dev/vuln/GO-2025-3765
- Import Source
- https://vuln.go.dev/ID/GO-2025-3765.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GO-2025-3765
- Aliases
- Published
- 2025-07-21T15:05:07Z
- Modified
- 2025-07-28T20:30:10.808648Z
- Summary
- SQL injection vulnerability in github.com/uptrace/bun/driver/pgdriver
- Details
-
SQL injection vulnerability in github.com/uptrace/bun/driver/pgdriver
- Database specific
{ "url": "https://pkg.go.dev/vuln/GO-2025-3765", "review_status": "REVIEWED" }- References
-
- https://github.com/advisories/GHSA-h4h6-vccr-44h2
- https://github.com/uptrace/bun/blob/1573ae7c2fffad1a7f72fd2d205e924b2fd4043b/driver/pgdriver/format.go#L62
- https://github.com/uptrace/bun/tree/master/driver/pgdriver
- https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn%27t%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf
- https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw
Affected packages
Go / github.com/uptrace/bun/driver/pgdriver
Package
- Name
- github.com/uptrace/bun/driver/pgdriver
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/uptrace/bun/driver/pgdriver