pgAdmin 4 Vulnerable to Remote Code Execution

HIGH 8.8CVE-2025-2945 · GHSA-g73c-fw68-pwx3 · PYSEC-2026-451 · Published 03/04/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
pgadmin4 PyPI	`< 9.2`	`9.2`
pgadmin 4 pgadmin	`< 9.2`	`9.2`

Description

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules).

The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.

This issue affects pgAdmin 4: before 9.2.

NVD description

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.

References

nvd.nist.gov/vuln/detail/CVE-2025-2945 · ADVISORY
pgadmin-org/pgadmin4 · WEB
pgadmin-org/pgadmin4 commit 75be0bc · WEB
pgadmin-org/pgadmin4 · PACKAGE
pypi.org/project/pgadmin4 · PACKAGE
GitHub Advisory GHSA-g73c-fw68-pwx3 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free