CVE-2025-2945: pgAdmin 4 Vulnerable to Remote Code Execution

April 3, 2025 (updated April 4, 2025)

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules).

The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.

This issue affects pgAdmin 4: before 9.2.

References

github.com/advisories/GHSA-g73c-fw68-pwx3
github.com/pgadmin-org/pgadmin4
github.com/pgadmin-org/pgadmin4/commit/75be0bc22d3d8d7620711835db817bd7c021007c
github.com/pgadmin-org/pgadmin4/issues/8603
nvd.nist.gov/vuln/detail/CVE-2025-2945

Code Behaviors & Features

Detect and mitigate CVE-2025-2945 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →