A SQL injection flaw exists in PostgreSQL Anonymizer’s import functions, allowing a malicious user to inject code into a JSON rule file. When a superuser executes the functions anon.import_database_rules() or anon.import_roles_rules(), the injected code runs with superuser privileges, effectively granting the attacker full control over the database. This vulnerability is a classic CWE‑89 injection flaw. The attacker can compromise confidentiality, integrity, and availability of the data and the system.

The flaw affects the Dalibo PostgreSQL Anonymizer extension. Versions older than 3.1.1 are vulnerable, while 3.1.1 and later include a fix.

The flaw carries a CVSS score of 6.4. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a superuser to invoke the import functions, implying that compromise of a superuser account or elevation of a privileged user to superuser level can exploit the flaw. Once executed, the attacker gains full superuser rights within the database environment.