A critical SQL injection vulnerability in the pg_partman PostgreSQL extension allows authenticated users to escalate privileges and achieve arbitrary command execution as the database service account.

The vulnerability is an SQL injection flaw occurring because the extension fails to properly sanitize the part_config.time_dncoder value before interpolating it into dynamic SQL. An attacker with standard partman_user privileges can inject malicious SQL payloads that execute with the elevated privileges of the PostgreSQL background worker.

The potential impact of this vulnerability is severe, as it facilitates full database compromise and cross-boundary execution of operating-system commands. Given the CVSS score of 8.5, this high-severity flaw represents a significant risk to data integrity, confidentiality, and system availability. Successful exploitation could allow an attacker to bypass existing database security controls, leading to total system takeover.

Immediate Action: Update the pg_partman extension to version 5.5.0 or later immediately to incorporate the necessary identifier quoting fixes.

Proactive Monitoring: Review PostgreSQL logs for unusual SQL execution patterns, specifically monitoring for unexpected commands originating from the pg_partman background worker process.

Compensating Controls: Restrict access to the partman_user role to only the most trusted administrative accounts, and ensure the PostgreSQL service account is running with the least privilege necessary to limit the impact of potential command execution.

Public Exploit Available: Unknown

This vulnerability presents a significant security risk due to the potential for privilege escalation and remote code execution within the database environment. Organizations utilizing pg_partman must prioritize updating to version 5.5.0 to eliminate the injection vector. Given the ability of this flaw to persist across maintenance ticks, failure to patch could result in long-term unauthorized access that is difficult to detect after the initial compromise.