{"id":"CVE-2025-2945","published":"2025-04-03T12:23:14Z","modified":"2026-02-26T18:28:58Z","title":"pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment","vendor":"pgadmin.org","product":"pgAdmin 4","tier":"core","eol":null,"affectedVersions":[{"vendor":"pgadmin.org","product":"pgAdmin 4","versions":["< 9.2"]}],"description":{"text":"Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).\n\nThe vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.\n\n\nThis issue affects pgAdmin 4: before 9.2.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in pgAdmin 4's Query Tool and Cloud Deployment modules, where two POST endpoints, /sqleditor/query_tool/download (via the query_commited parameter) and /cloud/deploy (via the high_availability parameter), pass user-supplied input unsafely to Python's eval() function. An attacker with low-privilege authenticated access to the application can send crafted requests to these endpoints to execute arbitrary code, without requiring user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:23Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.563,"percentile":0.9905,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/8603","tags":["issue-tracking"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<9.2"],"patched":["9.2"],"from":["GHSA-g73c-fw68-pwx3","PYSEC-2026-451"],"provenance":"source"}],"advisories":[{"id":"GHSA-g73c-fw68-pwx3","url":"https://github.com/advisories/GHSA-g73c-fw68-pwx3","severity":"CRITICAL","ecosystem":"PyPI","package":"pgadmin4","vulnerableRanges":["<9.2"],"patched":["9.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2025-9605","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-9605","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":0,"earliest":"2025-06-03","earliestUrl":"https://github.com/abrewer251/CVE-2025-2945_PgAdmin_PoC","repos":[{"name":"Cycloctane/cve-2025-2945-poc","url":"https://github.com/Cycloctane/cve-2025-2945-poc","stars":8,"created":"2025-09-13"},{"name":"abrewer251/CVE-2025-2945_PgAdmin_PoC","url":"https://github.com/abrewer251/CVE-2025-2945_PgAdmin_PoC","stars":3,"created":"2025-06-03"},{"name":"Udayveer17/CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-","url":"https://github.com/Udayveer17/CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-","stars":2,"created":"2025-11-26"},{"name":"I3r1h0n/pgAdminOpendoor","url":"https://github.com/I3r1h0n/pgAdminOpendoor","stars":0,"created":"2025-11-10"},{"name":"plur1bu5/CVE-2025-2945-pgadmin-rce","url":"https://github.com/plur1bu5/CVE-2025-2945-pgadmin-rce","stars":0,"created":"2026-03-16"}]},"metasploit":[{"name":"pgAdmin Query Tool authenticated RCE (CVE-2025-2945)","module":"exploit/multi/http/pgadmin_query_tool_authenticated","type":"exploit","disclosureDate":"2025-04-03","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pgadmin_query_tool_authenticated.rb"}],"first":{"date":"2025-04-03","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pgadmin_query_tool_authenticated.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-04-03","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-2945","provenance":"source"},{"date":"2025-04-03","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-06-03","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pgadmin_query_tool_authenticated.rb","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":31.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.81,"detail":"percentile 0.9905"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"7 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}