Open-source package vulnerability · PyPI

CVE-2025-2945: pgAdmin 4 Vulnerable to Remote Code Execution

criticalCVSS 3.1 9.9GHSA-g73c-fw68-pwx3

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/querytool/download, where the querycommited parameter and /cloud/deploy endpoint, where the highavailability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.

Published Apr 3, 2025 · Updated Apr 4, 2025

Affected packages

pgadmin4

Ecosystem: PyPI
Affected: < 9.2
Fixed in: 9.2
Check: pip show pgadmin4

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules).

The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.

This issue affects pgAdmin 4: before 9.2.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More PyPI vulnerabilities

All PyPI entries