# CVE-2026-116241: pgAdmin 4 Import/Export Data command injection via backslash escape bypass

Source: https://junglewise.ai/threats/cve-2026-116241-pgadmin-4-s-import-export-data-tool-wraps-a-user-s-query-export  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-116241 · Severity: critical · CVSS 9.9 · Published 2026-10-30

pgAdmin 4's Import/Export Data tool allows database administrators and authorized users to export query results. An attacker with database access can craft a malicious query that bypasses pgAdmin's validation checks by exploiting how backslashes are handled in double-quoted identifiers. This allows execution of arbitrary operating system commands on the pgAdmin host with the privileges of the pgAdmin process.

Vendors: [Pgadmin-Org](https://junglewise.ai/threats/vendors/pgadmin-org).

## Quick answers

**Is CVE-2026-116241 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116241 being exploited in the wild.

**How severe is CVE-2026-116241?** Critical severity, with a CVSS score of 9.9, published 30 October 2026.

**Which products and versions are affected?** Pgadmin-Org pgAdmin 4 before 9.19.

**Is there a fix for CVE-2026-116241?** Yes: fixed in pgAdmin 4 9.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116241 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116241?** Check whether you run Pgadmin-Org pgAdmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in pgAdmin 4 9.19

## Technical details

The vulnerability is a bypass of CVE-2026-17566's fix. pgAdmin validates that exported queries are wrapped in a psql \copy (...) TO wrapper by checking parentheses balance; however, it incorrectly handles backslash escaping in double-quoted identifiers. When standard_conforming_strings is off on the database connection, a backslash-escaped double quote does not close the identifier in psql's parser, but pgAdmin treats it as closing, allowing an attacker to hide a closing parenthesis. This causes a TO PROGRAM clause to execute via psql's popen() on the pgAdmin host before the database rejects the malformed statement. Any database role can disable standard_conforming_strings for itself, and the Import/Export Data permission defaults to non-administrators.

## Affected products

- pgadmin-org pgAdmin 4 before 9.19

## Timeline

- 2026-10-30: disclosed
- 2026-10-30: advisory: CVE-2026-116241 published

## References

- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/import_export/__init__.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/import_export/__init__.py)
- [https://github.com/pgadmin-org/pgadmin4/commit/9be31a019f780647fb689c458408c8803263c812](https://github.com/pgadmin-org/pgadmin4/commit/9be31a019f780647fb689c458408c8803263c812)