Executive brief
A vulnerability in the pgAdmin 4 AI Assistant allows an attacker to bypass security restrictions and modify database data or execute commands on the server. By placing malicious content in database fields that the AI Assistant reads, an attacker can trick the system into running unauthorized commands. This could lead to complete data loss, unauthorized data modification, or a full takeover of the database server if the user has high-level permissions.
Technical details
The pgAdmin 4 AI Assistant's 'execute_sql_query' tool fails to properly restrict LLM-generated SQL to a single read-only statement. While queries are wrapped in a 'BEGIN TRANSACTION READ ONLY' block, an attacker can use prompt injection (via database content the AI reads) to generate a multi-statement payload starting with 'COMMIT' or 'ROLLBACK'. This terminates the read-only transaction, allowing subsequent malicious statements to run in autocommit mode. If the pgAdmin user has superuser privileges, this can be escalated to remote code execution (RCE) on the database host using 'COPY ... TO PROGRAM'. The vulnerability is fixed in version 9.16 by implementing strict statement parsing and keyword validation.
Affected products
- pgadmin.org pgAdmin 4 9.13 to 9.15
Timeline
- 2026-06-08: patched: Fix committed to repository
- 2026-06-19: advisory: CVE published and NVD entry created