Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.9, published 19 May 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-05-19: Diesel version 2.3.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run diesel (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Diesel argument injection in PostgreSQL COPY FROM and COPY TO

Severity: medium · CVSS 6.9 · Published 2026-05-19

Diesel, a popular database toolkit for the Rust programming language, contains a vulnerability in its PostgreSQL data transfer features. When applications allow users to influence settings for bulk data imports or exports (COPY FROM/TO), an attacker could inject unauthorized database options. This could lead to data being processed incorrectly or security settings being bypassed during large-scale data movements, though it does not allow for the execution of entirely new database commands.

Technologies: diesel (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.9, published 19 May 2026.
Which products and versions are affected?: diesel (crates.io) < 2.3.8.
Is there a fix for This vulnerability?: A patch was published on 2026-05-19: Diesel version 2.3.8 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run diesel (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Diesel's implementation of PostgreSQL's `COPY FROM` and `COPY TO` statements fails to validate or escape single quote characters (`'`) in configuration options provided as strings or characters. An attacker who can control inputs to functions such as `with_delimiter`, `with_quote`, or `with_null` can inject additional options into the SQL statement. While this vulnerability is limited to the modification of options within the current `COPY` statement and does not permit the injection of entirely new SQL commands, it can lead to improper data handling or integrity issues. The issue is fixed in version 2.3.8 by implementing proper escaping for these arguments.

Affected products

diesel-rs diesel < 2.3.8

Timeline

2026-04-24: other: Vulnerability reported and fix PR opened
2026-05-13: advisory: RustSec advisory issued
2026-05-19: disclosed: GitHub Advisory published
2026-05-19: patched: Diesel version 2.3.8 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.