Skip to content

filter out meta commands when restoring plain postgres dumps #899

Description

@eug3nix

We have a RCE similar to: https://nvd.nist.gov/vuln/detail/CVE-2025-12762 and https://nvd.nist.gov/vuln/detail/cve-2025-13780:
psql executes meta commands like
\! "echo hello" > /tmp/confirmed.txt
when restoring plain backups
This may allow the attacker to execute arbitrary code on the remote server on on the local desktop app

psql 17+ has a \restrict option to disable meta commands (https://www.postgresql.org/docs/17/app-psql.html#APP-PSQL-META-COMMAND-RESTRICT) but this would not solve the issue entirely.

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions