What’s Vulnerable › Vulnerabilities

CVE-2023-22626: PgHero Allows Information Disclosure Through EXPLAIN Feature

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-01-05 · updated 2026-06-17
• Weakness: CWE-209

Description

PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server.)

Affected products

• Pghero Project Pghero: from 0.1.1 before 3.1.0 — fixed in 3.1.0
• Rubygems Pghero: before 3.1.0; 0.0.1, 0.0.2, 0.0.3, 0.1.0, 0.1.1, 0.1.10 (+68) — fixed in 3.1.0

How to fix

Upgrade to a fixed version: Pghero Project Pghero 3.1.0; Rubygems Pghero 3.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/ankane/pghero/issues/439
• https://github.com/ankane/pghero/issues/439

Get alerted when CVE-2023-22626 or the next vulnerability affects your stack