CVE-2026-120153: PostgreSQL extension-script substitutions allow SQL injection through object names
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which deployments are actually affected?
Affected deployments use PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, or 14.25 and have a non-bundled extension whose script uses the vulnerable substitution pattern. The issue does not apply solely because PostgreSQL is installed; the vulnerable extension-script pattern must be present.
What access does an attacker need?
An attacker needs database-level CREATE privilege. They can use a schema or owner name containing newlines or other special substrings to exploit vulnerable extension-script substitutions.
What is the impact of successful exploitation?
Successful exploitation can allow arbitrary code execution as the bootstrap superuser. This can affect confidentiality, integrity, and availability.
What should be prioritized for remediation?
Upgrade PostgreSQL to 18.7, 17.12, 16.16, 15.20, or 14.25, as applicable. Also identify non-bundled extensions and review their scripts for vulnerable substitution patterns involving schema or owner names.