CVEvulnerability

CVE-2026-19633

8.8 HIGH Published 2026-09-06 Modified 2026-09-09 Official page ↗
Status
Awaiting Analysis
Published
2026-09-06
Last modified
2026-09-09
Assigner
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS 3.1 (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89

Description

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References