NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · PyPI

CVE-2025-12762: pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode

criticalCVSS 3.1 9.1GHSA-w2p4-p4rh-qcm3

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

Published Nov 13, 2025

Affected packages

pgadmin4

Ecosystem
PyPI
Affected
< 9.10
Fixed in
9.10
Check
pip show pgadmin4

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

Credited to jonbally.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More PyPI vulnerabilities

All PyPI entries