A high-severity SQL injection vulnerability in pg_partman allows authenticated users to escalate privileges to superuser and execute arbitrary operating system commands.

The vulnerability stems from improper neutralization of SQL command elements in exception handlers, where parent table names are concatenated into SQL strings. An authenticated user with sufficient permissions to create tables can inject malicious SQL, which executes with the privileges of the pg_partman background worker, typically defaulting to a PostgreSQL superuser.

Successful exploitation leads to a complete compromise of the database environment and the underlying host server. Because the injected code runs with superuser privileges, an attacker can exfiltrate sensitive data, modify database records, or achieve persistent command execution on the host operating system. Given the CVSS score of 8.5, this vulnerability represents a critical threat to data integrity and infrastructure security.

Immediate Action: Update the pg_partman extension to version 5.5.0 or later immediately to apply the required input sanitization.

Proactive Monitoring: Review PostgreSQL logs for suspicious table creation activities or anomalous SQL syntax errors that may indicate an attempt to trigger exception handlers.

Compensating Controls: Restrict database user permissions to prevent unauthorized users from creating new partitioned tables or modifying pg_partman configuration settings until the update is applied.

Public Exploit Available: No

The potential for privilege escalation to superuser status makes this vulnerability a priority for all database administrators. Organizations using pg_partman with pg_jobmon enabled should verify their current version immediately and proceed with the upgrade to 5.5.0 to eliminate this critical attack vector.