CVE-2026-120153 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL extension-script substitutions do not escape schema or owner names, so a crafted name containing newlines or special substrings injects SQL. An attacker with database-level CREATE privilege can run arbitrary code as the bootstrap superuser.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any PostgreSQL server before 18.7, 17.12, 16.16, 15.20 or 14.25 is affected. Exposure needs a non-bundled extension with a vulnerable script pattern and a user who holds database-level CREATE privilege. Servers where only trusted administrators can create objects, or that run only bundled extensions, are less exposed.
Not affected if bundled-extensions-only, no-create-privilege-users, patched-version
Who cares database, postgresql, self-hosted
SELECT version(); and compare it to the fixed versions below.18.717.1216.1615.2014.25SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.