CVE-2025-13780: pgadmin4 has a Meta-Command Filter Command Execution
(updated )
The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark (EF BB BF) or other special byte sequences. The implemented filter uses the function has_meta_commands(), which scans raw bytes using a regular expression. The regex does not treat the bytes as ignorable, so meta-commands such as \\! remain undetected. When pgAdmin invokes psql with –file, psql strips the bytes and executes the command. This can result in remote command execution during a restore operation.
References
- github.com/advisories/GHSA-fxmw-jcgr-w44v
- github.com/pgadmin-org/pgadmin4
- github.com/pgadmin-org/pgadmin4/commit/1d397395f75320ca1d4ed5e9ca721c603415e836
- github.com/pgadmin-org/pgadmin4/commit/d5a909f14cb9713d89b49481ad1929fad89f4576
- github.com/pgadmin-org/pgadmin4/issues/9368
- github.com/pgadmin-org/pgadmin4/pull/9426
- nvd.nist.gov/vuln/detail/CVE-2025-13780
Code Behaviors & Features
Detect and mitigate CVE-2025-13780 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →