pgAdmin 4 up to 9.1 Cloud Deployment download eval query_commited code injection

Summaryinfo

A vulnerability marked as very critical has been reported in pgAdmin 4 up to 9.1. This issue affects the function eval of the file /sqleditor/query_tool/download of the component Cloud Deployment Module. Performing a manipulation of the argument query_commited results in Remote Privilege Escalation. This vulnerability was named CVE-2025-2945. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in pgAdmin 4 up to 9.1. It has been classified as very critical. This affects the function eval of the file /sqleditor/query_tool/download of the component Cloud Deployment Module. The manipulation of the argument query_commited with an unknown input leads to a remote privilege escalation vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-2945 since 03/29/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/11/2025). MITRE ATT&CK project uses the attack technique T1059 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 234350 (pgAdmin < 9.2 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (234350) and CERT Bund (WID-SEC-2025-0708). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Fedora Linux
• SUSE openSUSE
• Open Source pgAdmin

Productinfo

Name

• pgAdmin 4

Version

• 9.0
• 9.1

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion