Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field name during parsing and deparsing, too, but that is left as a future exercise.
Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Author: Nathan Bossart <[email protected]> Reviewed-by: Tom Lane <[email protected]> Reviewed-by: Etsuro Fujita <[email protected]> Security: CVE-2026-15741 Backpatch-through: 14 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/5e5ea74e389b0736adfc5aea3dd2ca102a997d65 Author: Nathan Bossart <[email protected]> Modified Files -------------- src/backend/utils/adt/ruleutils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
