CVE-2026-6464
Received Received - Intake

Command Injection in PostgreSQL psql

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: PostgreSQL

Description
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-6464
EUVD
EUVD-2026-57854

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
postgresql postgresql to 18.5 (exc)
postgresql postgresql to 17.11 (exc)
postgresql postgresql to 16.15 (exc)
postgresql postgresql to 15.19 (exc)
postgresql postgresql to 14.24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in PostgreSQL's psql client occurs when a COPY FROM STDIN or \copy FROM STDIN command fails early. The psql client may then incorrectly process subsequent data lines as psql commands instead of data. This happens because psql interprets the in-line data rows as commands when the server fails to indicate it is ready to receive input rows.

Detection Guidance

To detect this vulnerability, check the PostgreSQL version on your system using the command: psql --version. Compare the output against the affected versions (prior to 18.5, 17.11, 16.15, 15.19, and 14.24). If your version is outdated, the system is vulnerable.

Impact Analysis

An attacker could exploit this to execute arbitrary psql commands if they control both the server and the data rows. Even without full control, a coincidental error might allow an attack. This could lead to unauthorized data access, modification, or system compromise, depending on the commands executed.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations using affected PostgreSQL versions may face compliance violations, data breaches, and potential legal consequences if exploited.

Mitigation Strategies

Immediately upgrade PostgreSQL to a patched version (18.5 or later, 17.11 or later, 16.15 or later, 15.19 or later, or 14.24 or later). Avoid using "COPY FROM STDIN" or "\copy FROM STDIN" commands until the upgrade is complete. Review server logs for suspicious psql command executions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6464. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart