CVE-2025-58450: pREST has Systemic SQL Injection Vulnerability

Deferred

AliasesGHSA-p46v-f2x8-qp98GO-2025-3941

Published 08-09-2025Last modified 09-09-2025

Vulnerability summary

CVE-2025-58450 is a critical (CVSS 9.3) vulnerability in prest. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 38.4% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.3 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

Critical · v4.0 (CVE.org)

EPSS score

0.44%

0%100%

Low · +0.08 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 3

OPENSUSE-SU-2025:15564-1 OPENSUSE-SU-2026:21483-1 SUSE-SU-2025:03289-1

Timeline

08-09-2025
PublishedVulnerability first disclosed.
09-09-2025
Last modifiedVulnerability information updated.

Description

pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database. SQL injection is possible in versions prior to 2.0.0-rc3. The validation present in versions prior to 2.0.0-rc3 does not provide adequate protection from injection attempts. Version 2.0.0-rc3 contains a patch to mitigate such attempts.

CVSS metrics

3 scores · 3 sources · 1 version

v4.09.3

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

Increase +0.08 pp

From 0.36% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL CommandThe product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Github.com/prest1 product

prestAll versions (No fix recorded)

Github.com/prest/prest1 product

v2All versions (No fix recorded)

Prest1 product

prest< 2.0.0-rc3

3 vendors · 3 products

References

4 links

github.com/prest/prest/security/advisories/GHSA-p46v-f2x8-qp98X Refsource CONFIRMWEBAdvisory
github.com/prest/prest/commit/47d02b87842900f77d76fc694d9aa7e983b0711cX Refsource MISCWEBFIX
nvd.nist.gov/vuln/detail/CVE-2025-58450Advisory
github.com/prest/prestPACKAGE