CVE-2026-120153— PostgreSQL extension-script substitutions allow SQL injection through object names
Quick assessment
Affected
n/a PostgreSQL
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PostgreSQL 扩展脚本替换功能中存在 SQL 注入漏洞。该漏洞允许拥有数据库级 CREATE 权限的攻击者，通过包含换行符或其他特殊子字符串的架构名或所有者名，以引导超级用户（bootstrap superuser）身份执行任意代码。此漏洞与 CVE-2023-39417 类似，但需要攻击者利用一个非捆绑（non-bundled）扩展，且该扩展的脚本中存在易受攻击的模式。受影响的版本包括 PostgreSQL 18.7 之前、17.12 之前、16.16 之前、15.20 之前以及 14.25 之前的所有版
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-120153
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PostgreSQL extension-script substitutions allow SQL injection through object names
Source: CVE Program / CVE List V5
Vulnerability Description
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | PostgreSQL | 18 ~ 18.7 | - |
|
II. Public POCs for CVE-2026-120153
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-120153
请登录查看更多情报信息。
Other References for CVE-2026-120153 (1)
Same Patch Batch · n/a · 2026-11-12 · 56 CVEs total
| CVE-2026-116331 | 8.8 HIGH | PostgreSQL min/max aggregate type confusion executes arbitrary code |
| CVE-2026-116307 | 8.8 HIGH | PostgreSQL plperl prepared-query use-after-free executes arbitrary code |
| CVE-2026-116309 | 8.8 HIGH | PostgreSQL plperl blessed-reference type confusion may execute arbitrary code |
| CVE-2026-120142 | 8.8 HIGH | PostgreSQL dropped-column type confusion executes arbitrary code |
| CVE-2026-120141 | 8.8 HIGH | PostgreSQL materialized set-returning function type confusion executes arbitrary code |
| CVE-2026-120139 | 8.8 HIGH | PostgreSQL tuple-size integer wraparound executes arbitrary code |
| CVE-2026-116336 | 8.8 HIGH | PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions |
| CVE-2026-116335 | 8.8 HIGH | PostgreSQL commutator or negator result-type confusion executes arbitrary code |
| CVE-2026-116332 | 8.8 HIGH | PostgreSQL portal setup use-after-free executes arbitrary code |
| CVE-2026-116315 | 8.8 HIGH | PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code |
| CVE-2026-120144 | 8.8 HIGH | PostgreSQL type-cache invalidation gap executes arbitrary code |
| CVE-2026-116329 | 8.8 HIGH | PostgreSQL statistics import type confusion executes arbitrary code |
| CVE-2026-116330 | 8.8 HIGH | PostgreSQL pg_dump tar restore.sql fails to block psql command injection |
| CVE-2026-116328 | 8.8 HIGH | PostgreSQL generation memory context integer wraparound executes arbitrary code |
| CVE-2026-116317 | 8.8 HIGH | PostgreSQL ts_rank_cd() heap buffer overflow may execute arbitrary code |
| CVE-2026-116326 | 8.8 HIGH | PostgreSQL plperl tied-object exceptions follow stale sigjmp_buf |
| CVE-2026-116323 | 8.8 HIGH | PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code |
| CVE-2026-116319 | 8.8 HIGH | PostgreSQL plperl reentrant return_next() use-after-free executes arbitrary code |
| CVE-2026-116320 | 8.8 HIGH | PostgreSQL plperl array and hash conversion use-after-free executes arbitrary code |
| CVE-2026-116318 | 8.8 HIGH | PostgreSQL pg_dump not-null constraint name allows SQL injection |
Showing top 20 of 56 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: PostgreSQL
-
CVE-2026-6467
PostgreSQL extension script schema mishandling executes arbi -
CVE-2026-6460
PostgreSQL type confusion after ALTER ... SET DATA TYPE exec -
CVE-2026-18447
PostgreSQL output parameter type confusion executes arbitrar -
CVE-2026-16240
PostgreSQL pg_basebackup can use backup manifest content as -
CVE-2026-16237
PostgreSQL INSERT ... ON CONFLICT can read or modify rows de
Same vendor: n/a
-
CVE-2026-126998
JeecgBoot Authentication Filter call OpenApiController.call -
CVE-2026-126997
JeecgBoot flow-run Endpoint a.class RestTemplate.exchange se -
CVE-2026-6467
PostgreSQL extension script schema mishandling executes arbi -
CVE-2026-6460
PostgreSQL type confusion after ALTER ... SET DATA TYPE exec -
CVE-2026-18447
PostgreSQL output parameter type confusion executes arbitrar
Same weakness: CWE-89
-
CVE-2026-116325
PostgreSQL reindexdb index name quoting allows SQL injection -
CVE-2026-116318
PostgreSQL pg_dump not-null constraint name allows SQL injec -
CVE-2026-76173
SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySof -
CVE-2026-40820
Authenticated SQLi in getVpnData function -
CVE-2026-12507
Authenticated remote code execution