Prisma and PostgreSQL vulnerable to NoSQL injection? A surprising security risk explained
aikido.dev | blog | #authentication-bypass | #postgresql | #nosql-injection | #input-validation | #orm | #operator-injection | #prisma
Summary
Prisma queries accept operator objects that attackers can abuse, so crafted input can bypass password checks even on PostgreSQL. The post demonstrates operator injection exploits and defenses.
- Published
- Collected
--- id: 2548 title: "Prisma and PostgreSQL vulnerable to NoSQL injection? A surprising security risk explained" source_domain: aikido.dev source_url: "https://www.aikido.dev/blog/prisma-and-postgresql-vulnerable-to-nosql-injection" published_at: "2025-02-14 00:00" tags: ["authentication-bypass", "postgresql", "nosql-injection", "input-validation", "orm", "operator-injection", "prisma"] phying_url: "https://phying.com/item/2548" lang: en --- # Prisma and PostgreSQL vulnerable to NoSQL injection? A surprising security risk explained ## Summary Prisma queries accept operator objects that attackers can abuse, so crafted input can bypass password checks even on PostgreSQL. The post demonstrates operator injection exploits and defenses. ## Intelligence Metadata - **Sources:** aikido.dev - **Published:** 2025-02-14 00:00 - **Original:** https://www.aikido.dev/blog/prisma-and-postgresql-vulnerable-to-nosql-injection - **Phying News:** https://phying.com/item/2548