# CVE-2026-17566: pgAdmin 4 OS command injection in Import/Export Data tool

Source: https://junglewise.ai/threats/cve-2026-17566-pgadmin-4-os-command-injection-in-import-export-data-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-17566 · Severity: critical · CVSS 9.9 · Published 2026-07-31

pgAdmin 4, a popular management tool for PostgreSQL databases, contains a vulnerability in its Import/Export Data feature. An attacker with basic user permissions can provide a specially crafted database query that bypasses security checks to execute arbitrary commands on the server hosting pgAdmin. This could lead to a full system takeover, unauthorized data access, or disruption of database operations.

## Quick answers

**Is CVE-2026-17566 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17566 being exploited in the wild.

**How severe is CVE-2026-17566?** Critical severity, with a CVSS score of 9.9, published 31 July 2026.

**Which products and versions are affected?** pgadmin.org pgAdmin 4 < 9.17.

**Is there a fix for CVE-2026-17566?** A patch was published on 2026-07-31: Fixed in pgAdmin 4 version 9.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17566 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-17566?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in pgAdmin 4's Import/Export Data tool. The component constructs a 'psql \copy' command by interpolating user-provided SQL into a Jinja template. A hand-written validation function, _is_query_parens_balanced(), incorrectly handles backslash-escaped single quotes by assuming 'standard_conforming_strings' is disabled. However, in supported PostgreSQL versions (13-18), this setting defaults to 'on', causing psql to treat the backslash as a literal and the subsequent quote as a string terminator. An attacker can exploit this logic discrepancy to break out of the \copy wrapper and inject a 'TO PROGRAM' clause, leading to arbitrary command execution via popen(). The vulnerability is reachable via the POST /import_export/job/<sid> route and requires 'tools_import_export_data' permissions. The fix, introduced in version 9.17, conservatively rejects any backslashes within single-quoted strings in these queries.

## Affected products

- pgadmin.org pgAdmin 4 < 9.17

## Timeline

- 2026-07-27: disclosed: Reported by Arpit Jain
- 2026-07-31: patched: Fixed in pgAdmin 4 version 9.17
- 2026-07-31: advisory

## References

- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/import_export/__init__.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/import_export/__init__.py)
- [https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3](https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3)
- [https://github.com/pgadmin-org/pgadmin4/issues/10213](https://github.com/pgadmin-org/pgadmin4/issues/10213)