CVE-2019-9193

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.

• CWE-78

• http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.htmlThird Party Advisory
• http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html
• https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/Third Party Advisory
• https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5Exploit, Third Party Advisory
• https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190502-0003/Third Party Advisory
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/Third Party Advisory
• http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.htmlThird Party Advisory
• http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html
• https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/Third Party Advisory
• https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5Exploit, Third Party Advisory
• https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190502-0003/Third Party Advisory
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/Third Party Advisory

Published

Apr 1, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9185Controller/Async/FilesystemManager.php in the filemanager in…
• CVE-2019-9186In several JetBrains IntelliJ IDEA versions, a Spring Boot r…
• CVE-2019-9187ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3…
• CVE-2019-9189Prima Systems FlexAir, Versions 2.4.9api3 and prior. The app…
• CVE-2019-9191The ETSI Enterprise Transport Security (ETS, formerly known …
• CVE-2019-9192In the GNU C Library (aka glibc or libc6) through 2.29, chec…
• CVE-2019-9194elFinder before 2.1.48 has a command injection vulnerability…
• CVE-2019-9195util/src/zip.rs in Grin before 1.0.2 mishandles suspicious f…9.8
• CVE-2019-9196The Face authentication component in Aware mobile liveness 2…
• CVE-2019-9197The com.unity3d.kharma protocol handler in Unity Editor 2018…8.8
• CVE-2019-9199PoDoFo::Impose::PdfTranslator::setSource() in pdftranslator.…
• CVE-2019-9200A heap-based buffer underwrite exists in ImageStream::getLin…