CVE-2022-4223: pgAdmin4 Code Injection Vulnerability
Summary
CVE-2022-4223: pgadmin4 vulnerable to Code Injection. Affects pgadmin4 versions < 6.17. Fixed in 6.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin4 is a popular open-source administration and development platform for PostgreSQL, designed to provide a user-friendly interface for database management. It allows users to execute SQL queries, manage database objects, and perform various administrative tasks. However, certain versions of pgAdmin4 prior to 6.17 contain a vulnerability that exposes the application to potential code injection attacks through its HTTP API.
Vulnerability Detail
The vulnerability arises from the pgAdmin server's HTTP API, which is intended to validate paths to external PostgreSQL utilities like pg_dump and pg_restore. In versions prior to 6.17, this API was not adequately secured, allowing unauthenticated users to specify arbitrary paths. This could lead to the execution of malicious executables on the server, posing a significant security risk.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.17
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==6.17"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the pgAdmin server to trusted users only, and consider implementing network-level security measures to prevent unauthorized access to the HTTP API.
Conclusion
The pgAdmin4 vulnerability CVE-2022-4223 poses a significant risk due to its potential for code injection attacks. Users are strongly advised to update to version 6.17 or later to secure their installations. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for pgadmin4 →
FAQ
CVE-2022-4223 is a code injection vulnerability found in pgAdmin4 that allows unauthenticated users to execute arbitrary code on the server.
Versions of pgAdmin4 prior to 6.17 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
If you cannot update immediately, restrict access to the pgAdmin server and implement network security measures to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
