Description

SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:45.957Z",
  "pubdate": "2026-08-13T13:17:45.957Z",
  "executiveSummary": "An SQL injection vulnerability exists in PostgreSQL related to the EXTRACT() function deparse mechanism. This security flaw allows an unprivileged database object owner to execute arbitrary SQL commands with superuser privileges by embedding a hostile object definition. The vulnerability compromises expression deparse consumers broadly, impacting critical database utilities and administrative interfaces such as pg_dump and psql commands like \\sf, as well as third-party non-core tools that process expression trees. The risk implications are severe, as successful exploitation leads to complete database compromise and arbitrary code execution within the context of a superuser. The attack requires the adversary to possess object ownership capabilities within the database to craft the malicious object definition, which is subsequently processed by administrative tooling or automated maintenance workflows. Affected product versions include PostgreSQL deployments prior to 18.5, 17.11, 16.15, 15.19, and 14.24.",
  "technicalDetails": "The root cause of the vulnerability resides in the deparse logic of the PostgreSQL EXTRACT() function, specifically within how internal expression trees are converted back into SQL textual representations. When components such as pg_dump, interactive psql commands (e.g., \\sf), or other expression deparse consumers reconstruct SQL statements from system catalogs, improperly sanitized expressions originating from hostile object definitions are improperly handled. This flaw enables an attacker who owns a specific database object to inject malicious SQL payloads directly into the deparse output stream. The attack flow proceeds as follows: First, the malicious user creates or alters a database object incorporating a specially crafted expression within an EXTRACT() function call. Second, a privileged user, administrative process, or maintenance tool executes an operation that invokes the deparser on the affected object—such as generating a database schema backup via pg_dump or displaying the definition of a function or view. Third, as the deparser processes the internal representation, the malicious SQL payload is evaluated and rendered into the resulting output string without adequate escaping or context-aware sanitization. Finally, when the resulting script or command is subsequently executed, the injected SQL commands execute with the elevated privileges of the superuser running the administrative tool. The vulnerable component is the PostgreSQL server deparse subsystem handling EXTRACT() expressions. Affected software versions comprise PostgreSQL prior to 18.5, 17.11, 16.15, 15.19, and 14.24. Exploitation requires object ownership privileges within the target database, allowing the adversary to define the hostile object. No specific network exposure vector is inherently required for the initial payload placement beyond standard database access mechanisms capable of defining database objects, although the ultimate exploitation typically triggers when administrative consumers process the schema."
}