This vulnerability involves improper neutralization of special elements used in SQL commands within PostgreSQL's EXTRACT() deparse process. An attacker who owns an object can craft a hostile object definition that leads to execution of arbitrary SQL commands as a superuser. This impacts various expression deparse consumers, including core and non-core tools like pg_dump and psql's \sf command. The vulnerability affects multiple major PostgreSQL versions prior to the specified patch levels.

Successful exploitation allows an object owner to execute arbitrary SQL commands with superuser privileges, potentially leading to full system compromise, data disclosure, and data manipulation. The vulnerability affects multiple PostgreSQL versions and impacts both core and non-core tools that rely on expression deparse functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches or fixes are released, restrict object creation privileges to trusted users only and monitor for suspicious activity involving expression deparse consumers.