CVE-2023-39417

score

<0.1

cvss

7.5

epss

1.7%

published

2023-08-11

kev added

—

first seen

2026-10-21

PostgreSQL extension script contains a SQL injection caused by use of @extowner@, @extschema@, or @extschema:...@ inside quoting constructs, letting attackers with database CREATE privilege execute arbitrary code as superuser, exploit requires administrator to install vulnerable extension files.