agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: psql: Don't do backquote expansion in \unrestrict. 5+ messages / 1 participants [nested] [flat]
* pgsql: psql: Don't do backquote expansion in \unrestrict. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Don't do backquote expansion in \unrestrict. This oversight in commit 71ea0d6795 allows a malicious server to inject shell commands into plain-text dump output that are run at restore time on the machine running psql. To fix, interpret all text after \unrestrict until the end of the line as its argument. Reported-by: Lucas Velgus <velgusgus599@gmail.com> Reported-by: Filip Janus <fjanus@redhat.com> Reported-by: Daniel Bakker <daniel@jackds.nl> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Noah Misch <noah@leadboat.com> Security: CVE-2026-18408 Backpatch-through: 14 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/086f6f1760140a0055c2faa8d6831fd3ebaf96b0 Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- doc/src/sgml/ref/psql-ref.sgml | 5 +++++ src/bin/psql/command.c | 10 ++++++++-- src/bin/psql/t/001_basic.pl | 7 +++++++ 3 files changed, 20 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: psql: Don't do backquote expansion in \unrestrict. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Don't do backquote expansion in \unrestrict. This oversight in commit 71ea0d6795 allows a malicious server to inject shell commands into plain-text dump output that are run at restore time on the machine running psql. To fix, interpret all text after \unrestrict until the end of the line as its argument. Reported-by: Lucas Velgus <velgusgus599@gmail.com> Reported-by: Filip Janus <fjanus@redhat.com> Reported-by: Daniel Bakker <daniel@jackds.nl> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Noah Misch <noah@leadboat.com> Security: CVE-2026-18408 Backpatch-through: 14 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/0119aa30e0fc78771681cc54e4133bf7bd3a77dd Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- doc/src/sgml/ref/psql-ref.sgml | 5 +++++ src/bin/psql/command.c | 10 ++++++++-- src/bin/psql/t/001_basic.pl | 7 +++++++ 3 files changed, 20 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: psql: Don't do backquote expansion in \unrestrict. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Don't do backquote expansion in \unrestrict. This oversight in commit 71ea0d6795 allows a malicious server to inject shell commands into plain-text dump output that are run at restore time on the machine running psql. To fix, interpret all text after \unrestrict until the end of the line as its argument. Reported-by: Lucas Velgus <velgusgus599@gmail.com> Reported-by: Filip Janus <fjanus@redhat.com> Reported-by: Daniel Bakker <daniel@jackds.nl> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Noah Misch <noah@leadboat.com> Security: CVE-2026-18408 Backpatch-through: 14 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/71ca694c73cd1a808a393b2d5076e0518404468e Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- doc/src/sgml/ref/psql-ref.sgml | 5 +++++ src/bin/psql/command.c | 10 ++++++++-- src/bin/psql/t/001_basic.pl | 7 +++++++ 3 files changed, 20 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: psql: Don't do backquote expansion in \unrestrict. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Don't do backquote expansion in \unrestrict. This oversight in commit 71ea0d6795 allows a malicious server to inject shell commands into plain-text dump output that are run at restore time on the machine running psql. To fix, interpret all text after \unrestrict until the end of the line as its argument. Reported-by: Lucas Velgus <velgusgus599@gmail.com> Reported-by: Filip Janus <fjanus@redhat.com> Reported-by: Daniel Bakker <daniel@jackds.nl> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Noah Misch <noah@leadboat.com> Security: CVE-2026-18408 Backpatch-through: 14 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/0bfac9e1f946e098b1f61a642e71bb4844757472 Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- doc/src/sgml/ref/psql-ref.sgml | 5 +++++ src/bin/psql/command.c | 10 ++++++++-- src/bin/psql/t/001_basic.pl | 7 +++++++ 3 files changed, 20 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: psql: Don't do backquote expansion in \unrestrict. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org psql: Don't do backquote expansion in \unrestrict. This oversight in commit 71ea0d6795 allows a malicious server to inject shell commands into plain-text dump output that are run at restore time on the machine running psql. To fix, interpret all text after \unrestrict until the end of the line as its argument. Reported-by: Lucas Velgus <velgusgus599@gmail.com> Reported-by: Filip Janus <fjanus@redhat.com> Reported-by: Daniel Bakker <daniel@jackds.nl> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Noah Misch <noah@leadboat.com> Security: CVE-2026-18408 Backpatch-through: 14 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/33d0c63fb345f6b06893610a4a19644dd2450262 Author: Nathan Bossart <nathan@postgresql.org> Modified Files -------------- doc/src/sgml/ref/psql-ref.sgml | 5 +++++ src/bin/psql/command.c | 19 +++++++++++++++++-- src/bin/psql/t/001_basic.pl | 7 +++++++ 3 files changed, 29 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2026-08-10 13:41 UTC | newest] Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-10 13:41 pgsql: psql: Don't do backquote expansion in \unrestrict. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: psql: Don't do backquote expansion in \unrestrict. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: psql: Don't do backquote expansion in \unrestrict. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: psql: Don't do backquote expansion in \unrestrict. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: psql: Don't do backquote expansion in \unrestrict. Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox