CVE-2026-41167: Js Node Postgres Template Literal Sql Injectioncve-2026-41167-js-node-postgres-template-literal-sql-injection
SQL query is built by interpolating request-derived values into a JavaScript template literal and passed to `.query()` with no parameter values array. Under node-postgres, a missing params argument dispatches via the simple query protocol, which neither parameterises values nor blocks stacked (semicolon-separated) statements — enabling SQL injection and, wit
