Loading vulnerability…
Arbitrary command execution in PostgreSQL psql COPY FROM STDIN
CVE-2026-6464 is an untrusted-data inclusion vulnerability in PostgreSQL psql COPY processing. If COPY FROM STDIN or \copy FROM STDIN fails before the server signals readiness to receive input rows, psql interprets subsequent inline data rows as psql commands rather than data. A malicious server administrator can induce this condition through error injection, but must separately obtain control of the inline data to construct a complete deliberate attack. An attacker controlling only the data may succeed if a coincidental early failure occurs. COPY FROM operations specifying a filename are unaffected. Affected release branches are fixed in PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary psql command execution in the context of the operating-system user running the client. Malicious psql meta-commands can potentially execute operating-system commands, exposing or modifying information accessible to that account and disrupting client-side operations. The principal trust-boundary violation is execution on the psql client, not merely execution within the database server.
If you can’t patch tonight, do this now.
Until patched, avoid COPY FROM STDIN and \copy FROM STDIN with potentially attacker-controlled inline data, particularly against untrusted or compromised servers. Where feasible, use COPY FROM with a filename, which is unaffected. Restrict modification of COPY input data and administrative control of database servers. Trusting the server alone does not eliminate the risk from attacker-controlled rows combined with a coincidental early error.
Patch, then assume compromise.
Upgrade the affected psql client to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 or later within the corresponding supported branch, or install the distribution's equivalent security-fixed client package. Ensure scripts and automation invoke the updated psql executable; updating only a remote database server does not replace a vulnerable client.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
75 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.