The vulnerability in pg_partman versions before 5.5.0 stems from the inherit_template_properties() function, which encloses primary-key column names in double quotes without escaping embedded double-quote characters. A malicious partman_user owning a template table can craft a column name that breaks out of the ALTER TABLE ADD PRIMARY KEY SQL command generated during background worker operations. This leads to execution of arbitrary SQL with the privileges of pg_partman_bgw.role, which defaults to PostgreSQL superuser. The injected malicious SQL can cause database-wide compromise and allow execution of operating system commands as the PostgreSQL service account. The crafted catalog identifier remains persistent until removed and can be triggered again during subsequent partition creations. The vulnerability is fixed in version 5.5.0.

Successful exploitation allows an attacker with limited privileges (partman_user owning a template table) to execute arbitrary SQL commands with superuser privileges, resulting in full database compromise and potential operating system command execution as the PostgreSQL service account. The vulnerability persists until the malicious catalog identifier is removed and can be re-triggered during future partition operations.

Upgrade pg_partman to version 5.5.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Removing any crafted malicious catalog identifiers may be necessary to prevent re-triggering after upgrade.