---
id: 2548
title: "Prisma and PostgreSQL vulnerable to NoSQL injection? A surprising security risk explained"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/prisma-and-postgresql-vulnerable-to-nosql-injection"
published_at: "2025-02-14 00:00"
tags: ["authentication-bypass", "postgresql", "nosql-injection", "input-validation", "orm", "operator-injection", "prisma"]
phying_url: "https://phying.com/item/2548"
lang: en
---

# Prisma and PostgreSQL vulnerable to NoSQL injection? A surprising security risk explained

## Summary

Prisma queries accept operator objects that attackers can abuse, so crafted input can bypass password checks even on PostgreSQL. The post demonstrates operator injection exploits and defenses.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2025-02-14 00:00
- **Original:** https://www.aikido.dev/blog/prisma-and-postgresql-vulnerable-to-nosql-injection
- **Phying News:** https://phying.com/item/2548