AIKIDO-2026-532883
pg is vulnerable to SQL Injection
59
Medium Risk
This Affects:
pgTL;DR
PG::Connection#set_client_encoding passes the caller supplied encoding name into a command sent to the PostgreSQL backend. When an application forwards a user controlled or externally influenced encoding value to this method, unescaped SQL metacharacters in that value reach the backend as part of the command, so unexpected SQL executes on the connection. The patch stops building that command from the raw unvalidated argument.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass a user controlled or externally influenced value to set_client_encoding.
Background info
pg is vulnerable to SQL Injection in versions 0.7.9.2008.01.28 - 1.6.3.
How to fix this
Upgrade the pg library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.