PostgreSQL Inclusion of Functionality from Untrusted Control Sphere Vulnerability - CVE-2026-6464

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands via error injection. If the quotCOPY FROM STDINquot or quotcopy FROM STDINquot command fails before the server indicates that it awaits input rows psql processes the in-line data rows as psql commands. quotCOPY FROMquot with a filename is unaffected. The server administrator has no inherent control over the data rows so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively an attacker controlling data rows alone might complete an attack through a coincidental error that they don39t control. Versions before PostgreSQL 18.5 17.11 16.15 15.19 and 14.24 are affected.