CVE-2025-2945: pgAdmin 4 Remote Code Execution Vulnerability
Summary
CVE-2025-2945: pgAdmin 4 Vulnerable to Remote Code Execution. Affects pgadmin4 versions < 9.2. Fixed in 9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin 4 is a popular open-source administration and development platform for PostgreSQL, designed to provide a user-friendly interface for database management. It allows users to execute SQL queries, manage database objects, and perform various administrative tasks. However, certain modules within pgAdmin 4, specifically the Query Tool and Cloud Deployment modules, have been found to be vulnerable to a critical security issue that could allow remote code execution.
Vulnerability Detail
The vulnerability arises from the unsafe handling of user input in two specific POST endpoints: '/sqleditor/query_tool/download' and '/cloud/deploy'. In these endpoints, parameters such as 'query_commited' and 'high_availability' are passed directly to the Python eval() function without proper sanitization. This oversight allows an attacker to execute arbitrary Python code on the server, potentially leading to unauthorized access, data manipulation, or complete system compromise. The severity of this vulnerability is underscored by its CVSS score of 9.9, indicating a critical risk to affected systems.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.2
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==9.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to restrict access to the affected endpoints until the package can be updated. This can be done by implementing firewall rules or modifying server configurations to limit access to trusted users only.
Conclusion
The pgAdmin 4 vulnerability identified as CVE-2025-2945 poses a significant risk due to its potential for remote code execution. Users are strongly advised to update to the latest version to protect their systems from exploitation. Additionally, utilizing tools like Vulert can help monitor and alert users to such vulnerabilities in real-time.
See every vulnerability recorded for pgadmin4 →
FAQ
The vulnerability allows for remote code execution due to unsafe handling of user input in specific POST endpoints.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider restricting access to the vulnerable endpoints as a temporary workaround.
An attacker could execute arbitrary code on the server, leading to unauthorized access, data loss, or complete system compromise.
Yes, upgrading to pgAdmin 4 version 9.2 or later resolves the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
