A vulnerability in TimescaleDB versions 2.23.0 through 2.25.1 allows authenticated users to achieve arbitrary code execution via an untrusted search path flaw.

This vulnerability, categorized as CWE-426, involves the unsafe use of the search_path setting within PostgreSQL. An authenticated user with sufficient permissions to create objects in a writable schema can inject malicious functions that shadow legitimate system functions, leading to arbitrary code execution when the extension is upgraded.

The ability to achieve arbitrary code execution on a database server presents a critical risk to organizational data integrity and system availability. Successful exploitation could allow an attacker to gain full control over the database environment, facilitating unauthorized data exfiltration, modification, or total system compromise. Given the CVSS score of 8.8, this flaw represents a high-severity risk that requires immediate remediation to prevent potential lateral movement within the network.

Immediate Action: Update the TimescaleDB extension to version 2.25.2 or later, which contains the necessary security patch to address the search path vulnerability.

Proactive Monitoring: Review database audit logs for suspicious activity, specifically monitoring for the creation of unexpected functions or objects within user-accessible schemas.

Compensating Controls: Restrict permissions for creating functions or objects in public or shared schemas to highly trusted administrative accounts to reduce the attack surface.

Public Exploit Available: No (exploit_available unknown)

This vulnerability poses a significant risk to database security by enabling code execution through object shadowing. Organizations utilizing TimescaleDB must prioritize upgrading to version 2.25.2 immediately. Ensure that all database extensions are maintained at current, secure versions to prevent similar privilege escalation or code execution vectors.