{"id":"CVE-2026-96883","published":"2026-09-24T20:17:35.240","lastModified":"2026-09-25T13:16:34.693","description":"pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions.\n\n\n\nTo remediate this issue, users should upgrade to version 2.1.2 or later.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-843"],"vendors":[],"products":[],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-118-aws/","tags":[]},{"url":"https://github.com/aws/pgcollection/releases/tag/v2.1.2","tags":[]},{"url":"https://github.com/aws/pgcollection/security/advisories/GHSA-g539-cj32-hv6r","tags":[]}],"exploitRefs":[{"url":"https://github.com/aws/pgcollection/releases/tag/v2.1.2","tags":[]},{"url":"https://github.com/aws/pgcollection/security/advisories/GHSA-g539-cj32-hv6r","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw is a type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 that allows an authenticated remote user to execute arbitrary code as the postgres operating system user. This is due to crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions.","exploitability":"Exploitation is moderately hard as it requires an authenticated user and crafted SQL statements. Precondition is the presence of the vulnerable version of pgcollection and an authenticated user with SQL injection capabilities.","blast_radius":"If exploited, this flaw could result in complete compromise of the PostgreSQL server, allowing the attacker to execute arbitrary code with the privileges of the postgres user.","remediation":"Upgrade to AWS pgcollection 2.1.2 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","sql-injection","postgres","auth-required"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-29T09:03:44.880Z"}}