postgresql-cli
Audited by Socket on Jul 31, 2026
1 alert found:
SecurityNo direct malicious payloads (e.g., credential theft, network exfiltration, reverse shells) are evidenced in the provided fragment because it appears to be documentation/examples. However, it clearly demonstrates multiple high-impact execution primitives—\\gexec for runtime SQL execution and backquote expansion for host shell command execution—along with filesystem/script inclusion and COPY program piping. These capabilities are dangerous in automation contexts if any inputs or included content can be influenced or tampered with; this warrants strict input validation, least-privilege execution, and restricting or eliminating \\gexec/backquotes/\\copy-program/include patterns in untrusted pipelines.