Overview
From Postgresql:
Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal.
More information here:
- https://www.postgresql.org/support/security/CVE-2025-1094/
- https://www.rapid7.com/blog/post/2025/02/13/cve-2025-1094-postgresql-psql-sql-injection-fixed/
CodeSonar
CodeSonar never runs psql programmatically, but it does run Postgresql in single user mode in order to reset the database password when the hub administrator uses codesonar hub-start -setadminpw .... In that case, the user specifying the password has a shell where they can execute arbitrary commands anyway.
Users can delete psql from: [CodeSonar installation directory]/third-party/postgres[-version]/inst/bin/psql, if extra assurance that psql is not used is desired.