Vulnerability · Published Apr 3, 2025 · Assigned by PostgreSQL

CVE-2025-2945pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

Critical 9.9

In plain English

A critical-severity code injection in pgAdmin 4 from pgadmin.org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 56.3% (higher than 99.1% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)56.3%top 0.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Metasploit, Public PoC

Official description

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	pgadmin4	9.2	GHSA-g73c-fw68-pwx3
PyPI	pgadmin4	9.2	PYSEC-2026-451

Affected products (as reported)

Vendor	Product	Versions
pgadmin.org	pgAdmin 4	0 – before 9.2

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/pgadmin-org/pgadmin4/issues/8603 issue-tracking