TI-2025-02572 Aliases CVE-2025-2945 GHSA-g73c-fw68-pwx3

pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

HIGH 76CWE-94Published 2025-04-03 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.563 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed pgAdmin 4 (pgadmin.org): 9.2pgadmin4 (PyPI): 9.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pgadmin.org	pgAdmin 4	before 9.2	9.2	Patch available	CNA
—	pgadmin4 (PyPI)	before 9.2	9.2	Patch available	GHSA-g73c-fw68-pwx3

pgAdmin 4 Vendorpgadmin.org Affected before 9.2 Fixed in 9.2 Patch available CNA
pgadmin4 (PyPI) Vendor— Affected before 9.2 Fixed in 9.2 Patch available GHSA-g73c-fw68-pwx3

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pgadmin:pgadmin_4::::::postgresql::*	before 9.2	Vulnerable	pgadmin.org

cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* Versions before 9.2 Vulnerable ·pgadmin.org

Remediation

Fix · CNA pgAdmin 4 (pgadmin.org) Fixed in 9.2
Fix · GHSA-g73c-fw68-pwx3 pgadmin4 (PyPI) Fixed in 9.2 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-04-03
pgadmin.org pgAdmin 4 9.2
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2025-02573 Cross-site scripting in pgadmin.org pgAdmin 4Priority LOW 39
Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2025-2945
2026-10-03 Alias added: GHSA-g73c-fw68-pwx3

References

Exploit 1

https://github.com/pgadmin-org/pgadmin4/issues/8603

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-2945

Other 2

TI-2024-01901 Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 CVSS 3.1CRITICAL 9.9
TI-2024-02918 Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 CVSS 3.1CRITICAL 9.8
TI-2022-03867 Code injection in pgadmin4 CVSS 3.1HIGH 8.8
TI-2026-06875 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode CVSS 4.0CRITICAL 9.4
TI-2023-00228 Path traversal in pgadmin CVSS 3.1MEDIUM 6.5
TI-2025-11696 Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) CVSS 3.1CRITICAL 9.8

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences