CVE-2024-1713: High Privilege Escalation in PostgreSQL plv8

CVE-2024-1713 is a high severity (CVSS 7.2) privilege escalation flaw in the plv8 extension for PostgreSQL, version 3.2.1. A user who can create objects in a database with plv8 installed can cause deferred triggers to run as the superuser during autovacuum. Check the advisory for fix status.

What's affected

The Google Security Research advisory GHSA-r7m9-grw7-vcc4, published 21 February 2024, rates it High and lists affected version 3.2.1. The patched version field says none, while the advisory timeline lists a reported date of 9 January 2024 and a fixed date of 21 January 2024. Those do not line up cleanly, so read the plv8 release notes before assuming a state.

The NVD score is 7.2 (high) with vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:H. The weaknesses are CWE-394 (unexpected status code or return value) and CWE-754 (improper check for unusual or exceptional conditions). The advisory says it was tested against PostgreSQL 14.10 with plv8 3.2.1.

How to check if you're exposed

Check whether plv8 is installed and its version in each database.

SELECT extname, extversion FROM pg_extension WHERE extname = 'plv8';

Then list who can create objects in those databases, since the flaw needs that privilege. On managed services, check the provider's notes for the extension version.

What to do now

1. Find every database with plv8 installed and note the version.
2. Check the plv8 repository and release notes for a release that addresses the issue.
3. Revoke CREATE privileges from users who do not need them.
4. Consider whether you need plv8 at all, and drop the extension if not.
5. Monitor for unexpected superuser activity during maintenance windows.

Why it matters

The advisory explains that plv8 cursors lack rollbacks. If an error occurs in a cursor operation, the Postgres error is caught and rethrown as a JavaScript exception that user code can catch. The user can then commit when a rollback was expected, which breaks assumptions that deferred triggers depend on.

That ties it to an older problem, CVE-2020-25695, which the advisory cites as similar. The common thread is code that runs with superuser rights when maintenance work fires triggers that an unprivileged user defined. Not listed as exploited. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Google Security Research advisory

Last reviewed: 19 October 2026.