The vulnerability exists in pg_partman versions before 5.5.0 in functions run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), and partition_data_time(). These functions interpolate the writable part_config.time_dncoder text value without proper identifier quoting into dynamic SQL. A role with partman_user privileges can inject SQL code by storing malicious SQL instead of a decoder function name. When the affected operations execute, including background worker maintenance tasks, the injected SQL runs with elevated privileges, potentially the PostgreSQL superuser background-worker role. This persistent injection can lead to full database compromise and operating system command execution as the PostgreSQL service account. The vulnerability is addressed in pg_partman version 5.5.0.

Successful exploitation allows an attacker with partman_user privileges to execute arbitrary SQL commands with elevated privileges, including the PostgreSQL superuser background-worker role. This can result in complete compromise of the database and execution of operating system commands as the PostgreSQL service account, posing a critical risk to data confidentiality, integrity, and availability.

Upgrade pg_partman to version 5.5.0 or later, where this SQL injection vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 5.5.0.