AIKIDO-2026-63046

TL;DR

Serverpod's PostgreSQL and SQLite value encoders choose an encoding from a value's string content instead of the target column type. A string that begins with decode(' and ends with ', 'base64') is treated as serialized ByteData and inlined into SQL without escaping, so user controlled strings passed to ORM insert, update, or where comparisons break out of the query. This lets callers read arbitrary tables, bypass equality checks, and modify data at the application's database privileges through the documented ORM API with no raw query call. The fix drives encoding from the column type definition so text values are always escaped.