CVE-2025-1094

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2025-02-13

Last updated on: 2026-06-17

Assigner: PostgreSQL

Description

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-02-13

Last Modified

2026-06-17

Generated

2026-10-23

AI Q&A

2025-02-13

EPSS Evaluated

2026-10-20

NVD

CVE-2025-1094

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	PostgreSQL	17
n/a	PostgreSQL	16
n/a	PostgreSQL	15
n/a	PostgreSQL	14
n/a	PostgreSQL	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-149	Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

Attack-Flow Graph

Executive Summary

CVE-2025-1094 is a vulnerability in PostgreSQL that involves improper neutralization of quoting syntax in certain libpq functions (PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn()). This flaw allows a database input provider to perform SQL injection under specific conditions, particularly when the application uses the function results to construct input for the PostgreSQL interactive terminal (psql). Additionally, it affects command line utility programs when certain encoding settings are used. Versions prior to PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are vulnerable.

Detection Guidance

To detect this vulnerability, you can check the version of PostgreSQL running on your system. Use the following command in the PostgreSQL command line interface: `SELECT version();`. If the version is before PostgreSQL 17.3, 16.7, 15.11, 14.16, or 13.19, your system is vulnerable. Additionally, you can review application logs for any unusual SQL queries that may indicate SQL injection attempts.

Impact Analysis

This vulnerability can lead to SQL injection attacks, which may allow an attacker to manipulate database queries, potentially leading to unauthorized access to sensitive data, data corruption, or even complete system compromise. If your application relies on the affected PostgreSQL functions and does not properly handle user input, it could be exploited, resulting in significant security risks and operational disruptions.

Compliance Impact

The vulnerability could impact compliance with standards like GDPR and HIPAA by exposing sensitive personal and health information to unauthorized access through SQL injection attacks. Such breaches could lead to violations of data protection regulations, resulting in legal penalties, loss of customer trust, and potential financial repercussions. Organizations must ensure that their database interactions are secure to maintain compliance with these regulations.

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade your PostgreSQL installation to a version that is not affected: 17.3 or later, 16.7 or later, 15.11 or later, 14.16 or later, or 13.19 or later. Additionally, review your application code to ensure proper input validation and sanitization when using the affected libpq functions.

Hi! I’m here to help you understand CVE-2025-1094. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70