Untrusted data inclusion in PostgreSQL psql COPY allows a server administrator to trigger execution of data lines as psql commands through error injection. When a “COPY FROM STDIN” or "\copy FROM STDIN" command fails before the server indicates it is ready to receive rows, psql processes the in‑line data rows as commands. Thus, an attacker who can supply malicious data rows will have those rows executed as SQL commands, potentially modifying data or gaining further control. The flaw stems from improper handling of input data and is classified as CWE‑829.

This issue affects PostgreSQL servers running any version prior to 18.6, 17.11, 16.15, 15.19, or 14.24. The product is the PostgreSQL database engine, and the affected components are the psql client handling COPY FROM STDIN operations.

The CVSS score of 8.1 indicates high severity, but the exploitability is limited because the attacker must control both the PostgreSQL server with sufficient privileges to run COPY and the data rows that will be interpreted as commands. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Assuming an attacker can achieve the required conditions, they could inject arbitrary SQL, leading to high impact on confidentiality, integrity, and availability. The likely attack vector involves a combination of local privilege escalation via misuse of the COPY command and accidental or intentional data injection; this is inferred from the description because the attacker must simultaneously control the server and the data rows.