Skip to main content

PostgreSQL CVE-2025-1094

HIGH
Improper Neutralization of Quoting Syntax (CWE-149)
2025-02-13 f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
SQLi PostgreSQL Red Hat Suse
8.1
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-149
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
Impact

CVSS 8.1, EPSS 79.7%. PostgreSQL is the world's most advanced open source database, powering millions of applications. This vulnerability in the client library affects any application using these escape functions with psql. It was notably chained in the BeyondTrust Remote Support compromise (CVE-2024-12356), demonstrating real-world exploitation by sophisticated actors.
Exploit ScenarioDerived

An application accepts user input and passes it through PQescapeLiteral() before incorporating it into a command sent to psql. An attacker crafts input with specific quoting patterns that survive the escape function but break out of the intended SQL context in psql. They inject arbitrary SQL that executes with the application's database privileges, extracting sensitive data or modifying records.
Act Now Prioritize within 24-48h. Why: HIGH severity + EPSS > 10%.
Patch available 79.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperly neutralize quoting syntax, enabling SQL injection when function results are used to construct psql input. This vulnerability was used as the initial access vector in the BeyondTrust RS compromise chain.

Earlier versions of this analysis (1)
v1 Mar 28, 2026 - 18:26 CVSS 8.1

Quoting bypass in PostgreSQL libpq escape functions enables SQL injection when outputs are used in psql command construction.

RemediationAI

Update PostgreSQL to the latest patched version. Audit applications for patterns where libpq escape function outputs are passed to psql. Use parameterized queries instead of string escaping where possible. Review the BeyondTrust advisory chain for indicators of compromise.

Affected ProductsAI

PostgreSQL libpq (all versions before patch) Applications using PQescapeLiteral/PQescapeIdentifier/PQescapeString/PQescapeStringConn with psql

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The libpq escape functions are designed to safely quote strings for SQL statements. However, they fail to properly handle certain quoting syntax patterns, allowing an attacker who controls a database input value to inject SQL when the escaped output is used to construct commands for the psql client. This is particularly dangerous in applications that pipe escaped values into psql for execution.

Know when PostgreSQL gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 8.1 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch released
Apr 04, 2026 - 20:30 nvd
Patch available
PoC Detected
Feb 21, 2025 - 18:15 vuln.today
Public exploit code
CVE Published
Feb 13, 2025 - 13:15 nvd
HIGH 8.1

DescriptionCVE.org

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.

Executive ViewAI

Why It Matters

CVE-2025-1094 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. With an EPSS score of 80%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

Threat Score
5.5/10
Composite threat intelligence
EPSS Score
79.7%
Top 1% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS POC (1) Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 79.7%
Patch available Yes
Active threat Yes
Deciding rule
HIGH severity + EPSS > 10%
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Very High

Priority Score

155
Low Medium High Critical
KEV: 0
EPSS: +80
CVSS: +40
PoC: +20
Weaponized: +15
Threat intel: 0
Gov advisory: 0

Attack Technique

SQL Injection HIGH

SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.

More in PostgreSQL

View all
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2026-9586 CRITICAL POC
9.3 Jul 17

Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the

CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
CVE-2024-12909 CRITICAL POC
9.8 Mar 20

A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for

Same weakness CWE-149 – Improper Neutralization of Quoting Syntax

View all
CVE-2025-43878 HIGH
8.3
CVE-2026-42511 HIGH
8.1
CVE-2023-36479 LOW POC
3.1

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/manager/5.0/x86_64/server-migration-14-16:5.0.4.7.14.1 Container suse/multi-linux-manager/5.1/x86_64/server-migration-14-16:5.1.0.6.27 Image server-database-migration-image Image server-migration-14-16-image Affected
Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1 Affected
Container suse/multi-linux-manager/5.1/x86_64/server-postgresql:5.1.2.6.13.1 Container suse/postgres:16.9-13.5 Affected
Container suse/multi-linux-manager/5.1/x86_64/server:5.1.0.6.40 Affected
Container suse/postgres:18.1-61.1 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:1720 ADVISORY https://access.redhat.com/errata/RHSA-2025:1721 ADVISORY https://access.redhat.com/errata/RHSA-2025:1722 ADVISORY https://access.redhat.com/errata/RHSA-2025:1723 ADVISORY https://access.redhat.com/errata/RHSA-2025:1724 ADVISORY https://access.redhat.com/errata/RHSA-2025:1725 ADVISORY https://access.redhat.com/errata/RHSA-2025:1726 ADVISORY https://access.redhat.com/errata/RHSA-2025:1727 ADVISORY https://access.redhat.com/errata/RHSA-2025:1728 ADVISORY https://access.redhat.com/errata/RHSA-2025:1729 ADVISORY https://access.redhat.com/errata/RHSA-2025:1730 ADVISORY https://access.redhat.com/errata/RHSA-2025:1731 ADVISORY https://access.redhat.com/errata/RHSA-2025:1732 ADVISORY https://access.redhat.com/errata/RHSA-2025:1733 ADVISORY https://access.redhat.com/errata/RHSA-2025:1735 ADVISORY https://access.redhat.com/errata/RHSA-2025:1736 ADVISORY https://access.redhat.com/errata/RHSA-2025:1737 ADVISORY https://access.redhat.com/errata/RHSA-2025:1738 ADVISORY https://access.redhat.com/errata/RHSA-2025:1739 ADVISORY https://access.redhat.com/errata/RHSA-2025:1740 ADVISORY https://access.redhat.com/errata/RHSA-2025:1741 ADVISORY https://access.redhat.com/errata/RHSA-2025:1742 ADVISORY https://access.redhat.com/errata/RHSA-2025:1743 ADVISORY https://access.redhat.com/errata/RHSA-2025:1744 ADVISORY https://access.redhat.com/errata/RHSA-2025:1745 ADVISORY https://access.redhat.com/errata/RHSA-2025:3050 ADVISORY https://access.redhat.com/errata/RHSA-2025:3062 ADVISORY https://access.redhat.com/errata/RHSA-2025:3063 ADVISORY https://access.redhat.com/errata/RHSA-2025:3064 ADVISORY https://access.redhat.com/errata/RHSA-2025:3082 ADVISORY https://access.redhat.com/errata/RHSA-2025:3978 ADVISORY https://vuldb.com/vuln/295711 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:00614/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0606/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0614/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0615/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0616/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0618/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0619/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0631/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0632/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0633/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0634/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0635/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0636/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0637/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0655/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:0737/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14807/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14810/ REF http://www.openwall.com/lists/oss-security/2025/02/16/3 REF http://www.openwall.com/lists/oss-security/2025/02/20/1 REF https://lists.debian.org/debian-lts-announce/2025/02/msg00015.html REF https://lists.debian.org/debian-lts-announce/2025/02/msg00024.html REF https://security.netapp.com/advisory/ntap-20250221-0010/ REF https://www.postgresql.org/support/security/CVE-2025-1094/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy