CVE-2025-1094

PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

HIGH

8.1

CVSS Score

Published: February 13, 2025 at 01:00 PM UTC

Updated: June 17, 2026 at 08:38 AM UTC

1 product affected across 1 vendorPostgreSQL

Using PostgreSQL by N/A?

Get instant alerts when new vulnerabilities affect PostgreSQL - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.1

Exploit prediction

EPSS 90%

SSVC

PoC

Description

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

PostgreSQL · PostgreSQL

60%

v < 13.1914 ≤ v < 14.1615 ≤ v < 15.1116 ≤ v < 16.717 ≤ v < 17.314 15 16 17

Affected range stops below 13.19, so it looks safe — our inference, not a vendor statement

Affected range stops below 14.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 15.11, so it looks safe — our inference, not a vendor statement

Affected range stops below 16.7, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.