CVE-2026-6464

Descrição

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the -COPY FROM STDIN- or -\copy FROM STDIN- command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. -COPY FROM- with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don-t control. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.