CVE-2020-14350: Untrusted Search Path in PostgreSQL
Summary
GHSA-6v9v-3f4c-cjgx: Untrusted Search Path in PostgreSQL. Affects org.postgresql:postgresql versions < 12.4. Fixed in 12.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an open-source relational database management system known for its robustness, extensibility, and adherence to SQL standards. It is widely used in various applications and industries. This vulnerability affects versions before 12.4, 11.9, 10.14, 9.6.19, and 9.5.23 of PostgreSQL. The vulnerability arises from certain PostgreSQL extensions not securely using the search_path during their installation script.
Vulnerability Detail
The vulnerability allows an attacker with sufficient privileges to exploit the flawed installation script of certain PostgreSQL extensions. By tricking an administrator into executing a specially crafted script during the installation or update of such extensions, the attacker can execute arbitrary code. This can lead to various consequences, including unauthorized access, data manipulation, privilege escalation, and potential compromise of the entire PostgreSQL instance.
How To Fix
Latest published version: 42.7.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
12.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, administrators can manually review and modify the installation scripts of PostgreSQL extensions to ensure the safe usage of search_path. This involves carefully inspecting the scripts and validating the search_path usage to prevent any unauthorized or malicious code execution. However, applying the official updates is strongly recommended to address the vulnerability comprehensively.
Conclusion
The vulnerability in PostgreSQL versions before 12.4, 11.9, 10.14, 9.6.19, and 9.5.23 allows an attacker to execute arbitrary code by exploiting the flawed installation script of certain extensions. To mitigate this risk, it is crucial to update PostgreSQL to the recommended versions. Administrators can also manually review and modify installation scripts as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.postgresql:postgresql →
FAQ
PostgreSQL is an open-source relational database management system known for its robustness, extensibility, and adherence to SQL standards. It is widely used in various applications and industries.
Versions before 12.4, 11.9, 10.14, 9.6.19, and 9.5.23 of PostgreSQL are affected by this vulnerability.
By exploiting this vulnerability, an attacker with sufficient privileges can execute arbitrary code, leading to unauthorized access, data manipulation, privilege escalation, and potential compromise of the entire PostgreSQL instance.
To fix this vulnerability, it is recommended to update PostgreSQL to version 12.4, 11.9, 10.14, 9.6.19, or 9.5.23, depending on the affected version. Applying the official updates is crucial to mitigate the risk of exploitation.
As a workaround, administrators can manually review and modify the installation scripts of PostgreSQL extensions to ensure the safe usage of search_path. However, applying the official updates is strongly recommended.
Related vulnerabilities
Recent vulnerabilities recorded for org.postgresql:postgresql.
