postgres-github.git / summary / log / commit / refs

commit    46b4f5c11b0f2f6e6db834ffafc0d1a01a0373c1
Author:   Noah Misch <noah@leadboat.com>
Date:     Mon May 11 12:13:46 2026 +0000

    Fix SQL injection in logical replication origin checks.
    
    ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolates schema and
    relation names into SQL without quoting them.  A crafted subscriber
    relation name can inject arbitrary SQL on the publisher.  Test such a
    name.  Back-patch to v16, where commit
    875693019053b8897ec3983e292acbb439b088c3 first appeared.
    
    Reported-by: Pavel Kohout <pavel.kohout@aisle.com>
    Author: Pavel Kohout <pavel.kohout@aisle.com>
    Reviewed-by: Nathan Bossart <nathandbossart@gmail.com>
    Backpatch-through: 16
    Security: CVE-2026-6638

[parent: 5924e256c499]