# CVE-2026-120153: PostgreSQL extension-script SQL injection in object names

Source: https://junglewise.ai/threats/cve-2026-120153-sql-injection-in-postgresql-extension-script-substitutions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-120153 · Severity: high · CVSS 7.2 · Published 2026-11-12

PostgreSQL, a widely-used relational database server, contains a SQL injection vulnerability in how it processes extension installation scripts. An attacker with database creation privileges can craft malicious schema or owner names containing special characters to execute arbitrary code with superuser permissions, potentially compromising the entire database system.

Technologies: [PostgreSQL](https://junglewise.ai/threats/technologies/postgresql). Vendors: [PostgreSQL](https://junglewise.ai/threats/vendors/postgresql).

## Quick answers

**Is CVE-2026-120153 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120153 being exploited in the wild.

**How severe is CVE-2026-120153?** High severity, with a CVSS score of 7.2, published 12 November 2026.

**Which products and versions are affected?** PostgreSQL before 14.25, 15.20, 16.16, 17.12, 18.7.

**Is there a fix for CVE-2026-120153?** Yes: fixed in PostgreSQL 14.25, 15.20, 16.16, 17.12, 18.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120153 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120153?** Check whether you run PostgreSQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in PostgreSQL 14.25, 15.20, 16.16, 17.12, 18.7

## Technical details

SQL injection flaw in PostgreSQL extension-script substitutions allows privilege escalation from CREATE privilege to bootstrap superuser code execution through crafted object names (schema or owner) containing newlines or special substrings. The vulnerability requires a non-bundled extension with a vulnerable script pattern and network access to the database. A fix is available in the patched versions.

## Affected products

- PostgreSQL PostgreSQL before 14.25, 15.20, 16.16, 17.12, 18.7

## Timeline

- 2026-11-12: disclosed
- 2026-11-12: patched

## References

- [https://www.postgresql.org/support/security/CVE-2026-120153/](https://www.postgresql.org/support/security/CVE-2026-120153/)

## Related threats

- [PostgreSQL CREATE EXTENSION arbitrary SQL execution](https://junglewise.ai/threats/cve-2026-6467-uncontrolled-search-path-element-in-postgresql-create-extension)
- [PostgreSQL type confusion in ALTER allows arbitrary code execution](https://junglewise.ai/threats/cve-2026-6460-type-confusion-in-postgresql-allows-an-object-creator-to-execute)
- [PostgreSQL type confusion in SQL-language functions arbitrary code execution](https://junglewise.ai/threats/cve-2026-18447-type-confusion-in-postgresql-sql-language-functions-allows-an)
- [PostgreSQL INSERT ON CONFLICT authorization bypass on auto-updatable views](https://junglewise.ai/threats/cve-2026-16237-improper-protection-in-postgresql-insert-on-conflict-on-auto)
- [PostgreSQL dblink and subscriptions arbitrary file append](https://junglewise.ai/threats/cve-2026-14661-external-control-of-file-name-in-postgresql-dblink-and-create)