Critical Code Injection Vulnerability in PostgreSQL Packages
Summary
CVE-2025-8715: Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump,... Affects postgresql15 versions < 15.14-r0. Fixed in 15.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database system that uses and extends the SQL language. It is known for its reliability, robustness, and performance. The affected packages, including postgresql-13, postgresql-15, postgresql-16, and postgresql-17, are widely used in various applications for data storage and management. This vulnerability allows attackers to exploit the pg_dump utility, leading to potential code execution during the restoration process.
Vulnerability Detail
The vulnerability, identified as CVE-2025-8715, arises from improper neutralization of newlines in the pg_dump utility. This flaw allows a user of the origin server to inject arbitrary code that executes during the restoration of a database dump. Attackers can leverage this vulnerability to execute malicious commands as the client operating system account running the psql command. Additionally, superusers of the target server can achieve SQL injection through this attack vector. Versions prior to PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected, while versions before 11.20 are unaffected.
How To Fix
Minimum fixed version
15.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresql15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using pg_dump for creating database dumps until the packages are updated. Additionally, restrict access to the pg_dump utility to trusted users only to mitigate potential exploitation.
Conclusion
CVE-2025-8715 presents a significant risk to PostgreSQL users, allowing for potential code injection through the pg_dump utility. It is crucial to update affected packages to their patched versions to mitigate this vulnerability. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for postgresql15 →
FAQ
CVE-2025-8715 is a vulnerability in PostgreSQL that allows code injection during the restoration of database dumps due to improper handling of newlines in the pg_dump utility.
Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
If exploited, this vulnerability can lead to arbitrary code execution on the client system during database restoration, potentially compromising the entire database and server.
If immediate updates are not possible, restrict access to the pg_dump utility and avoid using it until the packages are patched.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql15.
