{"id":"GHSA-m9p2-fxp5-v3fp","aliases":["RUSTSEC-2026-0136"],"url":"https://o3.security/vulnerability/GHSA-m9p2-fxp5-v3fp","summary":"Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`","details":"Diesel allows users to configure various options for PostgreSQL's `COPY FROM` and `COPY TO` statements. These configurations are partially provided as strings or characters. \n\nDiesel did not check if any these user-provided options contain a quote character `'`, which can lead to the injection of additional options in the current `COPY FROM`/`COPY TO` statement. \n\nThis vulnerability affects any user of `COPY FROM`/`COPY TO` that passes user-provided input to any of the affected functions. It can result in modifications of options in the current statement, but it is not possible inject additional statements.\n\n## Mitigation\n\nThe preferred mitigation to the outlined problem is to update to Diesel version 2.3.8 or newer, which includes fixes for the problem.\n\n## Resolution\n\nDiesel now correctly escapes any quotes contained in the provided arguments.","published":"2026-05-19T19:42:00Z","modified":"2026-05-20T07:26:23.724197936Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"diesel","fixedVersion":"2.3.8"}],"fix":{"url":"https://github.com/diesel-rs/diesel/pull/5042","label":"diesel-rs/diesel#5042"},"references":[{"type":"WEB","url":"https://github.com/diesel-rs/diesel/pull/5042"},{"type":"PACKAGE","url":"https://github.com/diesel-rs/diesel"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2026-0136.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-05-20T07:26:23.724197936Z"}}