CVE-2025-1094

Improper neutralization of quoting syntax (CWE-149) in PostgreSQL's libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn(), and in PostgreSQL command-line utility programs, allows SQL injection. SQL injection is triggered when an application takes attacker-influenced database input, escapes it with these functions, and uses the result to construct input passed to the psql interactive terminal; the command-line utility variant requires client_encoding BIG5 with server_encoding EUC_TW or MULE_INTERNAL. An attacker who exploits this can run arbitrary SQL, with high confidentiality, integrity, and availability impact (CVSS 3.1: 8.1, high). All PostgreSQL releases before 17.3, 16.7, 15.11, 14.16, and 13.19 are affected across cloud and self-hosted deployments, though real-world exploitability depends on the specific usage patterns described. The flaw was exploited as a zero-day before the fixes, including in the US Treasury Department breach and in targeted attacks chained with a BeyondTrust zero-day, and EPSS puts the 30-day exploitation probability at 90%.

What to do: Upgrade all PostgreSQL installations to version 17.3, 16.7, 15.11, 14.16, or 13.19 (or later). Audit application code paths that pass libpq-escaped values (PQescapeLiteral/PQescapeIdentifier/PQescapeString/PQescapeStringConn) into psql, and check any use of PostgreSQL command-line utilities where client_encoding is BIG5 and server_encoding is EUC_TW or MULE_INTERNAL. Because this flaw was chained with the BeyondTrust zero-day in targeted attacks, review the exposure of remote-access appliances and hunt for anomalous SQL/psql activity.