pgadmin.org · pgAdmin 4
The flaw is in pgAdmin 4's Query Tool and Cloud Deployment modules, where two POST endpoints, /sqleditor/query_tool/download (via the query_commited parameter) and /cloud/deploy (via the high_availability parameter), pass user-supplied input unsafely to Python's eval() function. An attacker with low-privilege authenticated access to the application can send crafted requests to these endpoints to execute arbitrary code, without requiring user interaction.
Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.
Public exploit code (Metasploit) was available the same day.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: pgadmin4.
Upgrade to 9.2 or later
Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2022-4223, CVE-2024-2044, +2).
pip install "pgadmin4>=9.2"The first fix for CVE-2025-2945.
| If you run | Upgrade to |
|---|---|
| All versions before 9.2 | 9.2 |
“Up to” means the second version is the fix and is not affected.