A SQL injection flaw exists in PostgreSQL’s EXTRACT() function deparsing logic. An object owner can define a malicious expression that, when later deparsed by utilities such as pg_dump, psql commands like \sf, or other non‑core tools, injects arbitrary SQL statements executed with superuser privileges. This classic SQL injection (CWE‑89) permits full database compromise—reading, modifying, or deleting data and disrupting services.

This flaw affects PostgreSQL distributions before version 18.6, 17.11, 16.15, 15.19, and 14.24. Any component that performs expression deparse is impacted, including core utilities such as pg_dump, psql commands like \sf, and non‑core tools that rely on the same functionality.

The CVSS score of 8.8 indicates a high severity, and although the EPSS score is below 1 %, the vulnerability’s usage in widely deployed tools suggests a realistic exploitation probability. It is not listed in the CISA KEV catalog. The likely attack vector involves an object owner creating a hostile object definition with a crafted EXTRACT argument; when a tool or application later deparses that expression, the injected SQL is executed with superuser rights, enabling the attacker to steal or destroy data and take the database offline.