NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · PyPI

CVE-2025-13780: pgadmin4 has a Meta-Command Filter Command Execution

criticalCVSS 3.1 9.1GHSA-fxmw-jcgr-w44v

The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark (EF BB BF) or other special byte sequences. The implemented filter uses the function hasmetacommands(), which scans raw bytes using a regular expression.

Published Dec 11, 2025 · Updated Dec 12, 2025

Affected packages

pgadmin4

Ecosystem
PyPI
Affected
< 9.11
Fixed in
9.11
Check
pip show pgadmin4

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark (EF BB BF) or other special byte sequences. The implemented filter uses the function has_meta_commands(), which scans raw bytes using a regular expression. The regex does not treat the bytes as ignorable, so meta-commands such as \\! remain undetected. When pgAdmin invokes psql with --file, psql strips the bytes and executes the command. This can result in remote command execution during a restore operation.

Credited to zeropwn, Cycloctane.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More PyPI vulnerabilities

All PyPI entries