CVE-2019-9193: PostgreSQL COPY TO/FROM PROGRAM OS Command Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw yields OS command execution with high confidentiality, integrity and availability impact, and EPSS is extremely high, though exploitation requires authenticated privileged database access.

What it is

PostgreSQL 9.3 through 11.2 enables the COPY TO/FROM PROGRAM feature by default, allowing superusers and members of the pg_execute_server_program group to run arbitrary operating system commands as the database server user. The record notes that third parties dispute this as a vulnerability, arguing the behavior is intended functionality, but the NVD entry and multiple advisories treat it as OS command injection.

Impact

An attacker with the required database privileges gains arbitrary command execution in the context of the PostgreSQL operating system user, which can lead to full compromise of the database host and any data or credentials it can reach.

Attack surface

Reachable over the network via the PostgreSQL protocol (CVSS vector AV:N) by an authenticated user holding superuser rights or membership in the pg_execute_server_program group; no user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.91655, 99.8th percentile) and public references include an exploit-tagged writeup, indicating active interest and available proof-of-concept material.

What to do

• Upgrade PostgreSQL to a version after 11.2 where the record's affected range ends, or apply vendor guidance for your branch.
• Revoke superuser and pg_execute_server_program membership from accounts that do not strictly require it.
• Restrict network access to PostgreSQL to trusted hosts and require strong authentication.
• Audit and monitor use of COPY ... PROGRAM in database logs and application code.
• Where the feature is not needed, consider disabling or tightly controlling server-side program execution per vendor guidance.

Detection

• Search PostgreSQL logs for COPY statements containing PROGRAM, especially with shell metacharacters or unusual commands.
• Alert on new or changed membership in the pg_execute_server_program role and on superuser grants.
• Monitor database server processes for unexpected child processes spawned by the postgres user.
• Correlate database authentication events from unusual source IPs with subsequent OS command execution activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.