pgAdmin 4 CVE-2026-12045

Requires (1) the pgAdmin 4 AI Assistant feature to be enabled and configured with an LLM backend on a vulnerable version (9.13 ≤ v < 9.16); (2) attacker-controlled content reachable by the assistant - any row value, column value, object comment, or other database-stored text that the operator asks the assistant to inspect; (3) at least ordinary write privileges on some object in the target database (to plant the prompt-injection payload), reflected as PR:L in the CVSS vector; and (4) operator interaction (UI:P) where a pgAdmin user actually invokes the AI Assistant against the poisoned data. Impact is bounded by the privileges of the pgAdmin user's PostgreSQL role: ordinary write privileges yield unauthorized DML/DDL, while superuser or pg_execute_server_program membership extends the chain to OS command execution on the database server via COPY ... TO PROGRAM. Deployments that have not enabled the AI Assistant, or that pin pgAdmin operators to least-privilege roles, are not exploitable for RCE.

Vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, base 9.4) reflects network-reachable, low-complexity exploitation requiring only a low-privileged database account plus passive user interaction (the pgAdmin operator running the AI Assistant). EPSS and CISA KEV status are not provided in the input, and no public exploit was identified at time of analysis, so real-world exploitation pressure is currently unmeasured. The PR:L + UI:P combination is honest: the attacker needs write access to some object the assistant reads and an operator who actually invokes the assistant, which limits opportunistic mass exploitation but is highly realistic in shared-tenant PostgreSQL deployments. Severity escalates sharply when the pgAdmin user's role is a superuser or holds pg_execute_server_program (RCE on the DB host via COPY ... TO PROGRAM), so risk should be triaged against the operator's role privileges rather than against the CVSS number alone.

An attacker with ordinary INSERT/UPDATE rights on any table that a pgAdmin operator might inspect with the AI Assistant plants a row whose text column contains a prompt-injection payload instructing the LLM to call execute_sql_query with 'COMMIT; COPY (SELECT 1) TO PROGRAM ''id > /tmp/id.txt'';' or a DML statement. When the operator next asks the AI Assistant to explore that table, the LLM emits the multi-statement query; the leading COMMIT closes the READ ONLY wrapper and the subsequent statements execute under the operator's role, yielding unauthorized writes or, if the role is a superuser, shell command execution on the database host. Test cases in the fix commit confirm the COMMIT/END/ROLLBACK + COPY TO PROGRAM PoC family; no public weaponized exploit was identified at time of analysis.