CyberRota Analysis
AI-GeneratedPostgreSQL is vulnerable to SQL injection through the EXTRACT() deparse function, allowing an object owner to execute arbitrary SQL commands with superuser privileges via malicious object definitions. This vulnerability impacts various expression deparse consumers, including pg_dump and psql commands, posing a significant risk to database integrity and security. Organizations using affected versions prior to PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 should prioritize immediate patching to mitigate potential exploitation.
Original NVD Description
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.