Executive brief
pgAdmin 4, a popular management tool for PostgreSQL databases, contains a vulnerability in its Import/Export Data feature. An attacker with basic user permissions can provide a specially crafted database query that bypasses security checks to execute arbitrary commands on the server hosting pgAdmin. This could lead to a full system takeover, unauthorized data access, or disruption of database operations.
Technical details
An OS command injection vulnerability exists in pgAdmin 4's Import/Export Data tool. The component constructs a 'psql \copy' command by interpolating user-provided SQL into a Jinja template. A hand-written validation function, _is_query_parens_balanced(), incorrectly handles backslash-escaped single quotes by assuming 'standard_conforming_strings' is disabled. However, in supported PostgreSQL versions (13-18), this setting defaults to 'on', causing psql to treat the backslash as a literal and the subsequent quote as a string terminator. An attacker can exploit this logic discrepancy to break out of the \copy wrapper and inject a 'TO PROGRAM' clause, leading to arbitrary command execution via popen(). The vulnerability is reachable via the POST /import_export/job/<sid> route and requires 'tools_import_export_data' permissions. The fix, introduced in version 9.17, conservatively rejects any backslashes within single-quoted strings in these queries.
Affected products
- pgadmin.org pgAdmin 4 < 9.17
Timeline
- 2026-07-27: disclosed: Reported by Arpit Jain
- 2026-07-31: patched: Fixed in pgAdmin 4 version 9.17
- 2026-07-31: advisory