Untrusted data inclusion in PostgreSQL psql COPY allows a server administrator to trigger execution of data rows as psql commands after a failed COPY FROM STDIN operation. The flaw occurs when the command fails before the server signals readiness to receive rows, causing psql to interpret those rows as commands. As a result, an attacker who can supply malicious data rows can have those rows executed as SQL commands, potentially modifying data or gaining further control. The vulnerability stems from improper handling of input data and is classified as CWE‑829.

This issue affects PostgreSQL servers running any version prior to 18.5, 17.11, 16.15, 15.19, or 14.24. The product is the PostgreSQL database engine, and the affected components are the psql client handling COPY FROM STDIN operations.

The CVSS score of 8.1 indicates high severity, but the exploitability is limited because the attacker must control both the PostgreSQL server with sufficient privileges to run COPY and the data rows that will be interpreted as commands. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Assuming an attacker can achieve the required conditions, they could inject arbitrary SQL, leading to high impact on confidentiality, integrity, and availability. The attack vector is essentially a combination of local privilege escalation via COPY command misuse and data injection.