CVE-2025-13780: pgAdmin4 Meta-Command Filter Command Execution Vulnerability
Summary
CVE-2025-13780: pgadmin4 has a Meta-Command Filter Command Execution. Affects pgadmin4 versions < 9.11. Fixed in 9.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pgAdmin4 is a popular open-source administration and development platform for PostgreSQL, allowing users to manage databases through a web interface. It provides features such as query execution, database design, and user management. However, a recent vulnerability has been identified that affects its ability to properly filter meta-commands, potentially leading to security risks during database restore operations.
Vulnerability Detail
The vulnerability arises from the PLAIN restore meta-command filter in pgAdmin4, which fails to detect meta-commands when a SQL file starts with a UTF-8 Byte Order Mark (EF BB BF) or other special byte sequences. The filter utilizes the function has_meta_commands(), which scans raw bytes with a regular expression that does not ignore these bytes. As a result, meta-commands like \! can go undetected, allowing for remote command execution when pgAdmin invokes psql with the --file option, leading to serious security implications.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.11
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==9.11"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually check SQL files for any meta-commands before executing restore operations. Additionally, avoid using SQL files that contain UTF-8 Byte Order Marks or special byte sequences until the package is updated.
Conclusion
The CVE-2025-13780 vulnerability in pgAdmin4 poses a significant risk due to its potential for remote command execution. Users are strongly advised to update to the latest version to ensure their systems are secure. Additionally, temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for pgadmin4 →
FAQ
CVE-2025-13780 is a vulnerability in pgAdmin4 that allows for command execution due to improper filtering of meta-commands in SQL files.
This vulnerability can lead to remote command execution during database restore operations, potentially compromising your database security.
You should upgrade to pgAdmin4 version 9.11 or later to mitigate the vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
