What happened
Before 1.1.0, custom pl-do tools built a PostgreSQL DO block by concatenating JSON arguments into a fixed dollar-quote-delimited string without escaping. A crafted argument that included the dollar-quote tag broke out of the quoted region, letting an MCP client inject SQL executed with the connection's privileges.
Why it matters
An MCP client is normally an LLM agent. SQL injection here turns prompt-driven tool calls into arbitrary DB access for the connected role, letting an agent (or a prompt injection targeting that agent) read or modify database content beyond the intended tool contract.
Attack vector
Custom pl-do tools interpolated JSON arguments into a PostgreSQL DO block delimited by fixed dollar-quote tags. An argument containing the delimiter token could terminate the quote and inject arbitrary SQL as the connected database role.
Affected systems
pgedge-postgres-mcp < 1.1.0 (custom pl-do tools)
Mitigation
Upgrade to pgedge-postgres-mcp 1.1.0. Restrict MCP server access to trusted clients; bound the database role to least privilege.