A critical SQL injection flaw in the pg_partman PostgreSQL extension allows low-privileged users to escalate privileges to superuser and execute arbitrary operating system commands.

The extension fails to properly neutralize user-supplied input in the time_encoder configuration field, allowing an attacker with partman_user privileges to inject arbitrary SQL. This injected code is subsequently executed with the high privileges of the background worker process, typically the database superuser.

The potential impact of this vulnerability is total system compromise. Because the injected SQL executes with superuser privileges, an attacker can bypass all internal database security controls, exfiltrate sensitive data, or move laterally into the underlying host operating system. Given the CVSS score of 9.9, this vulnerability represents an existential risk to the integrity and confidentiality of any database environment utilizing the vulnerable extension.

Immediate Action: Update the pg_partman extension to version 5.5.0 or later immediately to incorporate the necessary identifier quoting and SQL sanitization.

Proactive Monitoring: Review database audit logs for suspicious activity involving the modification of part_config entries or unexpected executions by the pg_partman_bgw background worker process.

Compensating Controls: Restrict the partman_user role to the absolute minimum necessary permissions and ensure that the PostgreSQL service account operates with the least privilege required for its tasks at the operating system level.

Public Exploit Available: Unknown.

This vulnerability is of the highest severity and requires immediate attention from database administrators. Organizations currently running pg_partman versions prior to 5.5.0 should prioritize the update process, as the ability for a standard database user to escalate to superuser and command-line access constitutes an unacceptable security risk.