Pledge could only prevent this by effectively disabling the feature entirely. If you were to implement the necessary logic to determine which "LOCAL DATA" state

Pledge could only prevent this by effectively disabling the feature entirely. If you were to implement the necessary logic to determine which "LOCAL DATA" statements were legal and which weren't, it would be trivial from that point to block the illegal ones with or without pledge. Pledge is meant to be used for stopping your software from doing unanticipated things, not anticipated things. In this case they anticipated this behavior and purposely kept it even though it's potentially dangerous. EDIT: Sorry, perhaps you meant that the application which is embedding the MySQL client ought to use pledge. In that case, that does seem like a good defensive usage of pledge which would prevent this kind of attack, notwithstanding the need to fix the issue in the client itself.