A type confusion flaw exists in the AWS pgcollection extension for PostgreSQL. The mismatch between type metadata during collection value retrieval and array conversion can be triggered by crafted SQL statements. When an attacker with access to run SQL commands in the database executes such statements, the extension can execute arbitrary code with the privileges of the postgres operating system user.

AWS’ pgcollection extension for PostgreSQL is affected. Vulnerable versions are 2.0.0 through 2.1.1. Any environment running one of these releases as part of PostgreSQL is at risk.

The CVSS score of 8.7 indicates high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated remote database user able to issue custom SQL that follows the type‑confusion pattern. An attacker can then achieve arbitrary code execution, running as the postgres OS user, which grants full control over the database server and underlying operating system. No public exploits are reported, but the severity and potential impact make the risk significant.