CVE-2025-2945
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.
Analysis
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoints. The query_commited and high_availability parameters are passed directly to Python's eval() function, allowing authenticated users to execute arbitrary Python code on the pgAdmin server.
Technical Context
Two POST endpoints are affected: /sqleditor/query_tool/download (query_commited parameter) and /cloud/deploy (high_availability parameter). Both parameters are passed directly to Python's eval() function without sanitization. An authenticated pgAdmin user can inject arbitrary Python expressions that execute in the server's context with the pgAdmin process privileges.
Affected Products
['pgAdmin 4 (Query Tool and Cloud Deployment modules)']
Remediation
Update pgAdmin 4 to the latest patched version. Restrict pgAdmin access to trusted users and networks. Use strong authentication for all pgAdmin accounts. Run pgAdmin in a container with minimal filesystem and network access. Monitor pgAdmin logs for suspicious query tool download requests.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today