CVE-2026-19633— PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries
Quick assessment
Affected
DALIBO PostgreSQL Anonymizer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PostgreSQL Anonymizer 存在一个漏洞，允许非特权的“masked”用户通过滥用运算符、域转换（domain casts）或携带不可信表达式的视图子查询来执行任意代码。当这些对象在扩展的掩码（masking）机制上下文中被求值时，恶意代码可能会以更高的权限运行。该问题已在 PostgreSQL Anonymizer 3.1.4 及更高版本中修复。
Possible ATT&CK Techniques 1 AI
T1059.004 · Unix ShellAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| DALIBO | PostgreSQL Anonymizer | 1< 3.1.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19633
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries
Source: CVE Program / CVE List V5
Vulnerability Description
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| DALIBO | PostgreSQL Anonymizer | 1 ~ 3.1.4 | - |
|
II. Public POCs for CVE-2026-19633
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19633
请登录查看更多情报信息。
Other References for CVE-2026-19633 (1)
Same Patch Batch · DALIBO · 2026-09-06 · 3 CVEs total
| CVE-2026-83534 | 6.4 MEDIUM | PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_paral |
| CVE-2026-19634 | 6.4 MEDIUM | PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() v |
IV. Related Vulnerabilities
Same product: PostgreSQL Anonymizer
-
CVE-2026-83534
PostgreSQL Anonymizer: Privilege escalation to superuser via -
CVE-2026-19634
PostgreSQL Anonymizer: SQL injection in import_database_rule -
CVE-2026-13455
PostgreSQL Anonymizer: Unrestricted function can leak the se -
CVE-2026-11945
PostgreSQL Anonymizer: SQL injection in the rules import fun -
CVE-2026-9617
PostgreSQL Anonymizer: malicious column name allows SQL inje
Same vendor: DALIBO
-
CVE-2026-83534
PostgreSQL Anonymizer: Privilege escalation to superuser via -
CVE-2026-19634
PostgreSQL Anonymizer: SQL injection in import_database_rule -
CVE-2026-13455
PostgreSQL Anonymizer: Unrestricted function can leak the se -
CVE-2026-11945
PostgreSQL Anonymizer: SQL injection in the rules import fun -
CVE-2026-9617
PostgreSQL Anonymizer: malicious column name allows SQL inje
Same weakness: CWE-89
-
CVE-2026-86518
code-projects Student Crud Operation edit.php sql injection -
CVE-2026-86517
itsourcecode Sales and Inventory System us_searchfrm.php mys -
CVE-2026-44766
SQL Injection vulnerability in SAP S/4HANA (Intercompany Mat -
CVE-2026-86310
itsourcecode Sales and Inventory System cust_edit1.php sql i -
CVE-2026-86309
itsourcecode Sales and Inventory System pro_searchfrm.php sq
V. Comments for CVE-2026-19633
No comments yet