CVE-2026-120141 · Runtime
NO FIX YET · SEE WHAT TO DO
A flaw in PostgreSQL's materialized set-returning functions, such as json_populate_recordset(), causes a type confusion when rows with different dynamic RECORD return types are returned. A database user with query access can execute arbitrary code as the operating system user running the database.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any PostgreSQL server before the fixed releases is affected, and the risk is highest where untrusted or low-privilege database users can run queries that call functions such as json_populate_recordset(). Servers where only trusted administrators have database login can deprioritise it, though they should still upgrade. The sources do not state any non-default configuration that is required.
Not affected if patched-version, trusted-users-only
Who cares database, postgresql, self-hosted
SELECT version(); in psql and compare the server version against the fixed releases.18.717.1216.1615.2014.25Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.