pgAdmin 4 EUVD-2026-51564

Requires pgAdmin 4 9.13-9.16 with the AI Assistant feature enabled and connected to an LLM backend, targeting a PostgreSQL server running with standard_conforming_strings = on (PostgreSQL's default since 9.1) and the per-server 'Prepare threshold' field left blank (the pgAdmin default of None), which forces psycopg3 into the multi-statement-capable simple query protocol. The attacker must be able to plant the backslash-quote payload into any object the AI Assistant may read (indirect prompt injection), and a user must invoke the Assistant such that the LLM emits that content as an execute_sql_query tool call (UI:P). Exploitation is limited by these prerequisites: the optional AI Assistant must be turned on, the attack depends on the LLM reliably re-emitting the payload (non-deterministic), a low-privilege authenticated context is involved (PR:L), and setting a non-null Prepare threshold or a PostgreSQL configuration with standard_conforming_strings = off would break the parser-differential.

This is a genuine high-priority issue rather than an inflated CVSS score: the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:P) combined with high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems reflects a realistic path to write access and remote code execution (via COPY TO PROGRAM) on the database host. Working PoC payloads are published in the vendor's own security regression tests, and the technical writeup was verified against a live PostgreSQL 18 instance, so exploitability is concrete rather than theoretical. Countervailing factors lower real-world reach: exploitation requires the optional AI Assistant feature to be enabled with an LLM backend, a user to invoke the Assistant against attacker-controlled content (UI:P), and the indirect prompt-injection step depends on the LLM reliably emitting the payload as a tool call - a non-deterministic link. EPSS and KEV data are absent from the input, so probabilistic exploitation likelihood cannot be quantified and there is no confirmation of active exploitation; the risk is best read as high-impact but gated by feature adoption and the prompt-injection delivery path.

An attacker plants a crafted SQL string such as SELECT '\';COMMIT;CREATE TABLE pwn(x int);SELECT 1 --' inside a comment, table row, or object description the AI Assistant may later read. When a legitimate user asks the Assistant a question that causes the LLM to read and re-emit that content to execute_sql_query, sqlparse validates it as a single benign SELECT while PostgreSQL executes the smuggled COMMIT and follow-on statements, escaping the read-only wrapper to write data or, via COPY TO PROGRAM, run OS commands on the database host. Publicly documented PoC payloads (including COMMIT followed by COPY TO PROGRAM 'id > /tmp/id.txt') exist in the vendor's regression tests, and the network attack vector with low complexity makes the database-side execution reliable once the LLM emits the payload.