JLSEC-2026-38

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-38.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-38.json
JSON Data
https://api.osv.dev/v1/vulns/JLSEC-2026-38
Upstream
Published
2026-04-03T13:27:15.647Z
Modified
2026-04-03T13:30:10.149374Z
Summary
[none]
Details

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

Database specific 
{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "id": "CVE-2022-2625",
            "modified": "2024-11-21T07:01:23.017Z",
            "published": "2022-08-18T19:15:14.500Z",
            "imported": "2026-04-03T13:13:10.145Z",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2625",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-2625"
        }
    ]
}
References

Affected packages

Julia / LibPQ_jll

Package

Name
LibPQ_jll
Purl
pkg:julia/LibPQ_jll?uuid=08be9ffa-1c94-5ee5-a977-46a84ec9b350

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
16.0.0+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-38.json"