Untrusted Data Inclusion in PostgreSQL by PostgreSQL Global Development Group

CVE-2026-6464

What is CVE-2026-6464?

In PostgreSQL, a vulnerability exists in the psql COPY command that may permit a server administrator to unintentionally execute data lines as psql commands. This occurs when the 'COPY FROM STDIN' or '\copy FROM STDIN' command fails before the server indicates it is ready for input. In this scenario, psql treats the inline data as commands. The risk is heightened since the server administrator lacks control over these data rows, and an attacker could execute an attack by either taking control of both the server and the data rows or through coincidental error manipulation. Versions prior to PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are susceptible to this issue.

References