Critical PostgreSQL Vulnerability CVE-2025-1094 Enables Remote Code Execution

Technical Analysis

The vulnerability resides in PostgreSQL's libpq library — the C client interface used by virtually every PostgreSQL application. The flaw stems from improper handling of invalid UTF-8 byte sequences in the string escaping functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn().

An attacker can craft malicious input containing specific invalid UTF-8 sequences that cause the escaping routines to produce incorrectly quoted output. This effectively breaks out of SQL string literals, enabling arbitrary SQL injection even when applications believe they are using safe parameterized queries.

The BeyondTrust Connection

Rapid7 researchers discovered CVE-2025-1094 while investigating the BeyondTrust Remote Support vulnerability (CVE-2024-12356). The PostgreSQL flaw was the critical missing piece — the BeyondTrust RCE exploit chain actually required CVE-2025-1094 to achieve code execution. This means organizations that patched BeyondTrust but not PostgreSQL may still be vulnerable.

Attack Vector

The attack works by sending specially crafted UTF-8 byte sequences through any application that uses libpq for database connections. When the escaping functions process these invalid sequences, they produce syntactically valid but semantically corrupted SQL. In interactive terminal sessions (psql), this can escalate to operating system command execution via PostgreSQL's ! meta-command.

PostgreSQL is the world's most advanced open-source database, powering an estimated 800,000+ organizations globally. Every application using libpq — including popular frameworks like Django, Rails, and Node.js pg — is potentially affected.