Read-only transaction bypass in pgAdmin 4 AI Assistant (CVE-2026-17351)

A sqlparse/PostgreSQL lexer disagreement allows a crafted multi-statement payload to be classified as a single statement by sqlparse while PostgreSQL executes it as multiple statements, smuggling a COMMIT past the BEGIN TRANSACTION READ ONLY wrapper in the AI Assistant's execute_sql_query tool. This bypasses the fix for CVE-2026-12045 and allows an attacker to execute arbitrary write SQL or achieve remote code execution via indirect prompt injection, by planting a payload in any database object the AI Assistant may read. Affected versions: - pgAdmin 4 >= 9.13, < 9.17 We recommend updating to: pgAdmin 4 9.17. CVSS 9.4 · our assessment: act_now Reference: https://github.com/pgadmin-org/pgadmin4/issues/10192 Details: https://vuln.today/cve/CVE-2026-17351