A flaw in the PostgreSQL Anonymizer extension allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that include untrusted expressions. When these objects are evaluated by the extension’s masking logic, the malicious code runs with elevated privileges, enabling a full code execution and privilege escalation scenario. The weakness corresponds to SQL injection and related input validation failures.

The affected product is the DALIBO PostgreSQL Anonymizer extension. Versions below 3.1.4 are vulnerable. No explicit version list is provided, but the fix is introduced in 3.1.4 and later versions.

The CVSS score of 8.8 indicates a high severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation yet. Based on the description, it is inferred that the attack vector involves local or remote database access to a system where the extension is enabled; an attacker who can create or manipulate masked user expressions could gain full control of the database instance.