Code Injection in pgAdmin - CVE-2025-2945
Published: April 5, 2025 / Updated: August 14, 2026
Vulnerability identifier: #VU107018
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-2945
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote user to execute arbitrary Python code on the system.
The vulnerability exists due to usage of en insecure eval() expression within the in the Query Tool and Cloud Deployment features in web/pgadmin/tools/sqleditor/__init__.py and web/pgacloud/providers/google.py file. A remote user can send a specially crafted HTTP POST request and execute arbitrary Python code on the server.
Affected software
pgAdmin
Fedora
pgadmin4
Fedora
pgadmin4
How to mitigate CVE-2025-2945
Install updates from vendor's website.
pgAdmin - update to 9.2
pgadmin4 - update to 9.2-1.fc41
pgadmin4 - update to 9.2-1.fc41
Links to Public Exploits and PoC-codes
- Exploit #12911 - CVE-2025-2945 (Exploit for pgAdmin4 Remote Code Execution (RCE) vulnerability affecting versions 8.10 to 9.1.) (August 14, 2026)
- Exploit #12910 - CVE-2025-2945 (Exploit for pgAdmin4 Remote Code Execution (RCE) vulnerability affecting versions 8.10 to 9.1.) (August 14, 2026)
- Exploit #12366 - CVE-2025-2945_PgAdmin_PoC (February 6, 2026)
- Exploit #12137 - CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC- (November 28, 2025)
- Exploit #12108 - pgAdminOpendoor (Exploit and test stand for CVE-2025-2945) (November 14, 2025)
- Exploit #11969 - cve-2025-2945-poc (September 19, 2025)
- Exploit #11469 - CVE-2025-2945_PoC (June 6, 2025)
- Exploit #11294 - pgAdmin Query Tool authenticated RCE (CVE-2025-2945) (April 11, 2025)