{"id":"CVE-2026-19634","title":"PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions","summary":"PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() o…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-89"],"vendor":"DALIBO","product":"PostgreSQL Anonymizer","affected":["postgresql_anonymizer >= 1 < 3.1.4"],"published":"2026-09-06","updated":"2026-09-09","sourceUpdated":"2026-09-09T05:17:20.103","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19634","references":[{"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/665","label":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19634.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-19634"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19634"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-08T10:28:06.558688Z"},"epss":0.00185,"epssPercentile":0.08309,"ingestedAt":"2026-09-07T05:05:30.806Z","slug":"CVE-2026-19634","body":"## Overview\n\nPostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · updated 2026-09-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19634.json)","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}