Externally Controlled Reference to a Resource in Another Sphere

Summary

Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g., "PATH"). This often suffices to enable arbitrary code execution, even if the attacker lacks a database server operating system user. This issue affects PostgreSQL versions 12.x prior to 12.21, 13.x prior to 13.17, 14.x prior to 14.14, 15.x prior to 15.9, 16.x prior to 16.5, and 17.x prior to 17.1.