← CVE Intelligence

CVE-2026-19634

PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON PUBLISHED

Description (CNA)

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later

Affected (CNA)

Vendor / productVersions
DALIBO / PostgreSQL Anonymizeraffected 1 before 3.1.4

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.