SQL Injection Vulnerability in PostgreSQL Packages: CVE-2025-1094
Summary
CVE-2025-1094: Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in cer... Affects postgresql14 versions < 14.17-r0. Fixed in 14.17-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system known for its reliability, feature robustness, and performance. It supports advanced data types and offers extensive functionality for data management. However, certain versions of PostgreSQL, specifically versions prior to 17.3, 16.7, 15.11, 14.16, and 13.19, are vulnerable to SQL injection due to improper neutralization of quoting syntax in its libpq functions and command line utilities.
Vulnerability Detail
CVE-2025-1094 arises from improper neutralization of quoting syntax in PostgreSQL libpq functions such as PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn(). This vulnerability allows a database input provider to execute SQL injection attacks in specific usage patterns, particularly when the function results are used to construct input for psql, the PostgreSQL interactive terminal. Additionally, command line utility programs are also susceptible to SQL injection when client_encoding is set to BIG5 and server_encoding is either EUC_TW or MULE_INTERNAL. The implications of this vulnerability can lead to unauthorized data access or manipulation, posing a significant security risk.
How To Fix
Minimum fixed version
14.17-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresql14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the vulnerable functions to construct SQL queries directly from user input. Instead, implement parameterized queries or prepared statements to mitigate the risk of SQL injection.
Conclusion
CVE-2025-1094 is a critical SQL injection vulnerability affecting several versions of PostgreSQL. Users are strongly advised to update to the latest patched versions to protect their databases from potential exploitation. Implementing best practices for database security, such as using parameterized queries, can further enhance protection against SQL injection attacks.
See every vulnerability recorded for postgresql14 →
FAQ
CVE-2025-1094 is a vulnerability in PostgreSQL that allows for SQL injection due to improper neutralization of quoting syntax in certain libpq functions and command line utilities.
Versions prior to PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected by this vulnerability.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in software. You can check if your application is affected by using the Vulert playground at Vulert Scanner without needing to sign up.
The vulnerability can lead to unauthorized access to the database, data manipulation, and potential data breaches, posing a significant security risk.
If an immediate update is not possible, implement parameterized queries or prepared statements as a workaround to mitigate the risk of SQL injection.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql14.
