In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and…
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* | 9.3 – 11.2 | Vulnerable | PostgreSQL |
- cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions 9.3 – 11.2 Vulnerable ·PostgreSQL
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Not affected: 8 products
- CloudForms Management Engine 5
- Red Hat Ansible Tower 3
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Satellite 5
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2019-9193
- 2026-10-03 Alias added: GHSA-j83j-hfqj-cf5p
References
Advisory 5
- https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/
- https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/
- https://security.netapp.com/advisory/ntap-20190502-0003/
- http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html
More Postgresql vulnerabilities
- TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
- TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
- TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
- TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
- TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8
- TI-2018-00978 Improper input validation in postgresql CVSS 3.1HIGH 8.8
Sources
- CVE-2019-9193 · CVE Program
- CVE-2019-9193 · NVD
- FIRST EPSS
- GHSA-j83j-hfqj-cf5p · GitHub Advisory Database · CC BY 4.0
- CVE-2019-9193 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences