An SQL injection flaw exists in the PostgreSQL function pg_createsubscriber that allows an attacker with the pg_create_subscription privilege to inject arbitrary SQL statements. When the next execution of pg_createsubscriber occurs, the application runs the injected code with superuser authority, giving the attacker full control over the database instance, including confidential data, the ability to modify schema or data, and potential to execute system commands if the database configuration permits. The vulnerability is a classic SQL injection weakness (CWE‑89).

The issue affects PostgreSQL major version 17 from 17.0 up through 17.9, and major version 18 from 18.0 up through 18.3. Any PostgreSQL release prior to 17 is unaffected. Consequently organizations running PostgreSQL 17.1–17.9 or 18.0–18.3 are at risk.

The CVSS base score of 7.2 indicates a high severity, while no EPSS score is available at this time. The vulnerability is not present in the CISA KEV catalog. Because an attacker must hold pg_create_subscription rights—typically granted to privileged users—this flaw generally requires internal or compromised accounts. However, once enabled, the injected commands execute as superuser, maximizing impact. The flaw is exploitable via normal database usage; no additional network exposure is required beyond legitimate privileged database access.