CVE-2025-58450: Critical SQL Injection Flaw in pREST Puts PostgreSQL Databases at Risk

CVE-2025-58450 is described as a systemic SQL injection flaw in pREST that endangers users of its PostgreSQL REST API framework. The advisory notes the vulnerability affects versions prior to v2.0.0-rc3 and is rated CVSS 9.4 (Critical), with attackers able to read sensitive files, extract credentials, and manipulate database content.

Core REST endpoints for database operations, including GET, POST, PUT/PATCH and DELETE, were found vulnerable due to unsafe query construction that concatenates unvalidated input directly into SQL statements. The advisory warns that executing arbitrary commands on the database can lead to unauthorized data access and modification, and that PostgreSQL’s file-system access could enable further reach, potentially including arbitrary command execution.

Demonstrations show attackers could read files like /etc/passwd, steal secrets from environment variables, and extract password hashes from pg_shadow, with the pREST Docker container using a prest user that has “superuser” permissions increasing risk. pREST has released v2.0.0-rc3 to address the issue, recommending safer query construction, strict input validation, and shifting towards parametrised queries to ensure safe execution.