We have a RCE similar to: https://nvd.nist.gov/vuln/detail/CVE-2025-12762 and https://nvd.nist.gov/vuln/detail/cve-2025-13780:
psql executes meta commands like
\! "echo hello" > /tmp/confirmed.txt
when restoring plain backups
This may allow the attacker to execute arbitrary code on the remote server on on the local desktop app
psql 17+ has a \restrict option to disable meta commands (https://www.postgresql.org/docs/17/app-psql.html#APP-PSQL-META-COMMAND-RESTRICT) but this would not solve the issue entirely.
We have a RCE similar to: https://nvd.nist.gov/vuln/detail/CVE-2025-12762 and https://nvd.nist.gov/vuln/detail/cve-2025-13780:
psql executes meta commands like
\! "echo hello" > /tmp/confirmed.txtwhen restoring plain backups
This may allow the attacker to execute arbitrary code on the remote server on on the local desktop app
psql 17+ has a \restrict option to disable meta commands (https://www.postgresql.org/docs/17/app-psql.html#APP-PSQL-META-COMMAND-RESTRICT) but this would not solve the issue entirely.