CVE-2026-19634
6.4
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Summary
PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| DALIBO | PostgreSQL Anonymizer | 1 < 3.1.4 | affected |
Weaknesses
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Workarounds
Remove the rules import functions named anon.import_roles_rules() and anon.import_database_rules(). They are user-facing functions with no internal dependencies.
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.