A SQL injection vulnerability exists in SchemaHero 0.23.0 within the columnAsInsert function of the PostgreSQL plugin. By manipulating the column parameter, an attacker can influence the SQL statement that the tool constructs, potentially allowing the attacker to read or modify database content. This flaw is a classic instance of CWE‑89 and directly threatens the confidentiality and integrity of data managed by PostgreSQL.

SchemaHero, the Kubernetes schema‑management utility, is affected in version 0.23.0. The vulnerable code resides in the PostgreSQL plugin, so any deployment that exposes the API surface of this version is susceptible to exploitation.

The CVSS assessment of 7.4 indicates a high severity level, and the EPSS score is below 1 %, suggesting low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the exposed API endpoint, requiring only network access to the SchemaHero control plane. Once exploited, an attacker could potentially retrieve or tamper with any data housed in the targeting PostgreSQL instance, creating a significant risk to organizational assets.