Executive brief
Diesel, a popular database toolkit for the Rust programming language, contains a vulnerability in its PostgreSQL data transfer features. When applications allow users to influence settings for bulk data imports or exports (COPY FROM/TO), an attacker could inject unauthorized database options. This could lead to data being processed incorrectly or security settings being bypassed during large-scale data movements, though it does not allow for the execution of entirely new database commands.
Technical details
Diesel's implementation of PostgreSQL's `COPY FROM` and `COPY TO` statements fails to validate or escape single quote characters (`'`) in configuration options provided as strings or characters. An attacker who can control inputs to functions such as `with_delimiter`, `with_quote`, or `with_null` can inject additional options into the SQL statement. While this vulnerability is limited to the modification of options within the current `COPY` statement and does not permit the injection of entirely new SQL commands, it can lead to improper data handling or integrity issues. The issue is fixed in version 2.3.8 by implementing proper escaping for these arguments.
Affected products
- diesel-rs diesel < 2.3.8
Timeline
- 2026-04-24: other: Vulnerability reported and fix PR opened
- 2026-05-13: advisory: RustSec advisory issued
- 2026-05-19: disclosed: GitHub Advisory published
- 2026-05-19: patched: Diesel version 2.3.8 released