CVE-2019-9193

PostgreSQL has a shortcut that can copy data to or from an external program. If an attacker has the right database privileges, they can trick that feature into running commands on the server, like being able to “hand the database a shell command” and have it run it for them. Because it runs with the database server’s operating-system permissions, it can lead to serious harm if powerful database accounts are misused.

This matters if you run PostgreSQL versions 9.3 through 11.2 and you have database users who are superusers or are members of the pg_execute_server_program group. Your exposure increases sharply if any of those highly privileged accounts are reachable by an attacker (for example, via stolen credentials or an account compromise). This is mainly a risk when an attacker can use database-level power (superuser or that specific group) and then reach the “COPY TO/FROM PROGRAM” capability.

Treat this as AMBER because public exploits are available and the issue targets highly privileged database functionality that can directly lead to code execution on the server. Even though KEV listing is not provided in the findings, the combination of public exploit availability and no known patch means you should prioritize limiting who can use that feature and moving off the affected version range if possible.