A high-severity SQL injection vulnerability in the pg_partman PostgreSQL extension allows an authenticated user to achieve full database compromise and arbitrary operating system command execution.

The flaw resides in the inherit_template_properties function, which fails to properly escape primary key column names before incorporating them into SQL statements. An authenticated user with sufficient permissions to own a template table can inject malicious identifiers that execute with elevated background worker privileges, resulting in SQL injection.

The vulnerability poses a severe risk to organizational data integrity and infrastructure security. Because the injected SQL executes with PostgreSQL superuser privileges by default, an attacker can gain complete control over the database environment and potentially pivot to the underlying host operating system. Given the CVSS score of 8.5, this is a critical risk that could lead to full system compromise and significant data exfiltration.

Immediate Action: Upgrade the pg_partman extension to version 5.5.0 or later immediately to incorporate the necessary input sanitization fixes.

Proactive Monitoring: Review PostgreSQL audit logs for unusual ALTER TABLE commands or unexpected database-level activities initiated by the pg_partman background worker.

Compensating Controls: Restrict the privileges of the pg_partman background worker role to the minimum necessary level, rather than relying on default superuser permissions, to limit the blast radius of potential exploits.

Public Exploit Available: Unknown

Organizations utilizing pg_partman must prioritize patching to version 5.5.0 to eliminate this SQL injection vector. Failure to update leaves the database infrastructure exposed to total compromise, as the flaw provides a direct path for attackers to execute arbitrary system commands. Please coordinate with database administrators to schedule this update during the next maintenance window.