PostgreSQL Code Injection Vulnerability in pg_dump - ALPINE-CVE-2025-8715
Summary
ALPINE-CVE-2025-8715: Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump,... Affects postgresql15 versions < 15.14-r0. Fixed in 15.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. The vulnerability in question affects the pg_dump utility, which is used to back up PostgreSQL databases. This utility can be exploited due to improper handling of newlines in object names, allowing for potential code injection during restoration processes.
Vulnerability Detail
The vulnerability arises from improper neutralization of newlines in pg_dump, which allows a user to inject arbitrary code that executes during the restoration of a database. This can occur when a crafted object name containing psql meta-commands is processed. The ramifications include unauthorized code execution on the client operating system and potential SQL injection as a superuser on the target server. Versions of PostgreSQL prior to 17.6, 16.10, 15.14, 14.19, and 13.22 are affected, while versions before 11.20 are unaffected. This vulnerability was reintroduced after a previous fix (CVE-2012-0868).
How To Fix
Minimum fixed version
15.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresql15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using pg_dump with object names that may contain newlines or special characters until the package is updated. Additionally, consider using alternative backup methods that do not rely on pg_dump.
Conclusion
The PostgreSQL vulnerability ALPINE-CVE-2025-8715 poses significant risks due to improper handling of newlines in pg_dump. It is crucial to update to the patched versions of the affected packages to mitigate these risks. Users should also consider temporary workarounds and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for postgresql15 →
FAQ
The vulnerability allows for code injection during the restoration of a PostgreSQL database due to improper handling of newlines in object names.
Versions prior to 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected.
You can use Vulert's playground to check for vulnerabilities in your application without needing to sign up. Visit Vulert Scanner and upload your manifest file.
The risks include unauthorized code execution on the client system and SQL injection attacks on the target server, which could lead to data breaches or loss.
If immediate updates are not possible, avoid using pg_dump with potentially dangerous object names and consider alternative backup methods.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql15.
