PostgreSQL Anonymizer has a SQL injection flaw in the import functions. An attacker who can supply a crafted JSON document with malicious object names can cause the functions anon.import_database_rules() or anon.import_roles_rules() to execute arbitrary SQL when later run by a superuser. This leads to full code execution with superuser privileges, compromising database confidentiality, integrity, and availability.

The flaw affects the DALIBO PostgreSQL Anonymizer extension. All versions prior to 3.1.4 are vulnerable; versions 3.1.4 and above include the fix.

The CVSS score of 6.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to insert a malicious JSON file and later have a superuser execute one of the two import functions. Therefore the attack vector is internal or requires privileged user action, and the overall risk is moderate but significant for environments where the functions are used.