Untrusted data inclusion in pg_dump allows a superuser of the origin PostgreSQL server to craft a dump file that, when restored by a client using psql, injects arbitrary content in the psql \restrict meta-command expansion. The injected content is executed as the operating-system account that runs psql, resulting in code execution on the client system. The vulnerability is rooted in the \unrestrict command, which was sufficient to bypass the intended restriction.

Vulnerable releases include PostgreSQL 18.5 and earlier, 17.11 and earlier, 16.15 and earlier, 15.19 and earlier, and 14.24 and earlier. The flaw affects the core server, the psql client, pg_dump, pg_dumpall, and pg_restore when used to generate a plain-format dump. The issue is specific to superusers on the origin server and manifests during restore operations that involve psql.

The CVSS score of 8.8 indicates high severity, while the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker with superuser rights on a PostgreSQL instance create a malicious dump and that a victim subsequently restores it with psql. Because the attack succeeds only when the client executes the restoring command, the opportunity for compromise depends on that administrative activity. Given the high impact and the lack of a widely deployed mitigation, administrators should act promptly to limit the attack surface.