Vulnerability MediumRUSTSEC-2026-0136 · diesel
RUSTSEC-2026-0136: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`
Short answerA security vulnerability in the diesel crate: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`. GitHub rates it Medium. Fixed in 2.3.8: update to a fixed version.
| Crate | diesel |
|---|---|
| Type | Vulnerability (format-injection) |
| Affected versions | Before 2.3.8. |
| Fixed in | 2.3.8 |
| Severity | Medium (GitHub rating) |
| Published | 2026-04-24 |
| Last changed | 2026-05-20 |
| Also known as | GHSA-m9p2-fxp5-v3fp |
| Affected functions | diesel::pg::CopyFromQuery::with_default, diesel::pg::CopyFromQuery::with_delimiter, diesel::pg::CopyFromQuery::with_escape, diesel::pg::CopyFromQuery::with_null, diesel::pg::CopyFromQuery::with_quote, diesel::pg::CopyToQuery::with_delimiter, diesel::pg::CopyToQuery::with_escape, diesel::pg::CopyToQuery::with_null, diesel::pg::CopyToQuery::with_quote |
What to do
- See which version you have:
cargo tree -i diesel(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p diesel. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplediesel = "2.3.8") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
Diesel allows users to configure various options for PostgreSQL's COPY FROM and COPY TO statements. These configurations are partially provided as strings or characters.
Diesel did not check if any these user-provided options contain a quote character ', which can lead to the injection of additional options in the current COPY FROM/COPY TO statement.
This vulnerability affects any user of COPY FROM/COPY TO that passes user-provided input to any of the affected functions. It can result in modifications of options in the current statement, but it is not possible inject additional statements.
Mitigation
The preferred mitigation to the outlined problem is to update to Diesel version 2.3.8 or newer, which includes fixes for the problem.
Resolution
Diesel now correctly escapes any quotes contained in the provided arguments.
References
- Package: crates.io/crates/diesel
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0136.html
- Web: github.com/diesel-rs/diesel/pull/5042
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Other advisories for diesel
- Vulnerability CriticalRUSTSEC-2021-0037 · 2021-03-05Fix a use-after-free bug in diesels Sqlite backend
- VulnerabilityRUSTSEC-2024-0365 · 2024-08-23Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts
- UnsoundRUSTSEC-2026-0111 · 2026-04-24Possible UTF-8 corruption in Diesels SQLite backend
- UnsoundRUSTSEC-2026-0134 · 2026-04-24Unsound access to padding bytes while serializing date/time values using the Mysql backend
- UnsoundRUSTSEC-2026-0135 · 2026-04-24Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite backend
- VulnerabilityRUSTSEC-2026-0137 · 2026-04-24Possible unaligned data access for implementations of `SqliteAggregate`
- UnsoundRUSTSEC-2026-0172 · 2026-06-05Possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`
Up next
Same cratediesel: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?