Remote Code Execution Vulnerability in pgAdmin 4 by pgAdmin Development Team
CVE-2026-17566

9.4CRITICAL

Key Information:

Vendor

Pgadmin.org

Status
Pgadmin 4
Vendor
CVE Published:
31 July 2026

What is CVE-2026-17566?

A flaw in the Import/Export Data tool of pgAdmin 4 can allow an attacker to execute arbitrary commands on the PostgreSQL server. This occurs due to improper validation of user-supplied SQL queries that are injected into a Jinja template. The vulnerability results from an error in the parentheses balance checker, which fails to recognize that a backslash before a single quote is treated as an ordinary character when 'standard_conforming_strings' is enabled. This misinterpretation can lead to the acceptance of rogue commands, enabling the execution of malicious actions via the 'TO PROGRAM' clause. As a precaution, the fix implemented rejects any backslash inside single-quoted strings to prevent such command injection.

Affected Version(s)

pgAdmin 4 0 < 9.18

References

https://github.com/pgadmin-org/pgadmin4/issues/10213
issue-tracking
https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28...
patch

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arpit Jain (arpitjain099)
Ashesh Vashi <ashesh.vashi@enterprisedb.com>
.