#VU107018 Code Injection in pgAdmin - CVE-2025-2945

Vulnerability identifier: #VU107018

Vulnerability risk: Medium

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2025-2945

CWE-ID: CWE-94

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
pgAdmin
Web applications / Remote management & hosting panels

Vendor: PlanGenius Admin

Description

The vulnerability allows a remote user to execute arbitrary Python code on the system.

The vulnerability exists due to usage of en insecure eval() expression within the in the Query Tool and Cloud Deployment features in web/pgadmin/tools/sqleditor/__init__.py and web/pgacloud/providers/google.py file. A remote user can send a specially crafted HTTP POST request and execute arbitrary Python code on the server.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

pgAdmin: 8.10 - 9.1

---

External links
https://github.com/pgadmin-org/pgadmin4/issues/8603
https://github.com/pgadmin-org/pgadmin4/commit/75be0bc22d3d8d7620711835db817bd7c021007c
https://www.pgadmin.org/docs/pgadmin4/9.2/release_notes_9_2.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.