This vulnerability involves improper neutralization of special elements in an SQL command within PostgreSQL's logical replication feature. When a subscriber executes ALTER SUBSCRIPTION ... REFRESH PUBLICATION, it can lead to SQL injection, allowing execution of arbitrary SQL commands with the publication-side credentials. The issue affects PostgreSQL versions 16, 17, and 18, specifically minor versions before 16.14, 17.10, and 18.4. The vulnerability does not affect versions before 16. The CVSS 3.1 base score is 3.7, indicating low severity, with network attack vector, high attack complexity, low privileges required, and user interaction needed. No known exploits have been reported.

Successful exploitation allows a subscriber table creator to execute arbitrary SQL commands with the privileges of the publication-side, potentially leading to limited confidentiality and integrity impacts. The vulnerability does not affect availability. Given the low CVSS score and required conditions, the impact is considered low. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider upgrading to PostgreSQL versions 16.14, 17.10, or 18.4 or later once available. Additionally, restrict permissions to create subscriber tables to trusted users only to reduce risk.