CVE-2025-13780: pgAdmin4 Meta-Command Filter Command Execution Vulnerability
Summary
CVE-2025-13780: pgadmin4 has a Meta-Command Filter Command Execution. Affects pgadmin4 versions < 9.11. Fixed in 9.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin4 is a popular open-source administration and development platform for PostgreSQL, allowing users to manage databases through a web interface. It provides features such as query building, database design, and server management. However, it has been found to have a critical vulnerability that affects its ability to properly filter meta-commands in SQL files, particularly when they begin with special byte sequences.
Vulnerability Detail
The vulnerability arises from the PLAIN restore meta-command filter introduced in pgAdmin as a fix for a previous issue (CVE-2025-12762). This filter fails to detect meta-commands when a SQL file starts with a UTF-8 Byte Order Mark (EF BB BF) or other special byte sequences. The function 'has_meta_commands()' uses a regular expression that does not ignore these bytes, allowing meta-commands like '\!' to go undetected. Consequently, when pgAdmin invokes psql with the --file option, psql strips these bytes and executes the command, potentially leading to remote command execution during a restore operation.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.11
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==9.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using SQL files that start with a UTF-8 Byte Order Mark or other special byte sequences until you can update to the patched version. Additionally, you can manually inspect SQL files for any meta-commands before executing them.
Conclusion
In summary, CVE-2025-13780 is a critical vulnerability in pgAdmin4 that allows for command execution due to inadequate filtering of meta-commands. Users are strongly advised to update to version 9.11 or later to mitigate this risk. For those unable to update immediately, temporary workarounds are available.
See every vulnerability recorded for pgadmin4 →
FAQ
CVE-2025-13780 is a critical vulnerability in pgAdmin4 that allows for command execution due to improper filtering of meta-commands in SQL files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to remote command execution, allowing attackers to execute arbitrary commands on the server during a restore operation.
The CVSS score for this vulnerability is 9.1, indicating it is critical and should be addressed immediately.
If you cannot update to the patched version right away, avoid using affected SQL files and inspect them for meta-commands before execution.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
