Threats affecting pkg:github/repmgr

EnterpriseDB repmgr versions 4.0.0 through 5.5.0 contain an OS command injection vulnerability (CWE-78) in event notification commands. The vulnerability arises because placeholders %a (node name) and %c (connection string) are inserted into shell commands without proper escaping, allowing an attacker with non-superuser repmgr database credentials to execute arbitrary OS commands as the operating system user running repmgr. The flaw also affects the %a placeholder in failover_validation_command. The issue is fixed in version 5.5.1, and operators must remove any quotes around these placeholders after upgrading to prevent continued risk.