OS command injection in pgAdmin 4 Import/Export Data tool (CVE-2026-17566)

pgAdmin 4's Import/Export Data tool interpolates a user-supplied SQL query into a psql \copy command line without correctly validating parenthesis boundaries. The parenthesis-balance checker mishandled backslash-escaped single quotes, treating them as escaped under standard_conforming_strings=off semantics, while PostgreSQL defaults to on since version 9.1; a crafted query could therefore pass the guard while psql closed the string early, exposing an attacker-controlled TO PROGRAM clause that executes arbitrary OS commands via popen(). An authenticated user with the commonly-granted tools_import_export_data permission can exploit this remotely to achieve arbitrary command execution on the host running pgAdmin. Affected versions: - pgAdmin 4 < 9.17 We recommend updating to: pgAdmin 4 9.17. CVSS 9.4 · our assessment: act_now Reference: https://github.com/pgadmin-org/pgadmin4/issues/10213 Details: https://vuln.today/cve/CVE-2026-17566