Description
Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.
INFO
Published Date :
2025-04-03T12:23:14.792Z
Last Modified :
2026-02-26T18:28:58.124Z
Source :
PostgreSQL
AFFECTED PRODUCTS
The following products are affected by CVE-2025-2945 vulnerability.
| Vendors | Products |
|---|---|
| Pgadmin |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-2945.
| URL | Resource |
|---|---|
| https://github.com/pgadmin-org/pgadmin4/issues/8603 |
|
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact