The vulnerability in pg_partman versions before 5.5.0 involves improper neutralization of special elements in an SQL command (CWE-89). Specifically, the create_partition_time() function reads the part_config.time_encoder text value and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partman_user INSERT and UPDATE privileges can store malicious SQL instead of a function name. When the pg_partman background worker creates a child partition for text- or UUID-keyed sets, it executes this stored SQL with superuser privileges, enabling persistent privilege escalation and potential full database and OS compromise. The issue is resolved in version 5.5.0.

Successful exploitation allows a user with limited privileges (partman_user role) to execute arbitrary SQL commands with PostgreSQL superuser privileges via the background worker process. This can lead to complete database compromise and execution of operating system commands as the PostgreSQL service account, posing a critical risk to confidentiality, integrity, and availability of the database and underlying system.

Upgrade pg_partman to version 5.5.0 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 5.5.0.