A vulnerability in PostgreSQL's CREATE EXTENSION and ALTER EXTENSION commands allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. This occurs due to an uncontrolled search path element that leads a trusted-extension script to execute arbitrary SQL chosen by the attacker. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.