{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "aws-advanced-nodejs-wrapper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-13T22:22:37Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Description of Vulnerability: \nAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.\n\nAWS recommends that customers upgrade to the following version:  AWS NodeJS Wrapper to v2.0.1.\n\n\n### Source of Vulnerability Report:\nAllistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)\n\n\n### Affected products \u0026 versions: \nAWS NodeJS Wrapper \u003c 2.0.1.\n\n\n### Platforms: \nMacOS/Windows/Linux",
  "id": "GHSA-8wj8-cfxr-9374",
  "modified": "2025-11-13T22:22:37Z",
  "published": "2025-11-13T22:22:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-advanced-nodejs-wrapper/security/advisories/GHSA-8wj8-cfxr-9374"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-advanced-nodejs-wrapper/pull/574"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/aws/aws-advanced-nodejs-wrapper"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aws/aws-advanced-nodejs-wrapper/releases/tag/2.0.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AWS Advanced NodeJS Wrapper: Privilege Escalation in Aurora PostgreSQL instance"
}