CVE-2025-2945: pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
First published: Thu Apr 03 2025(Updated: )
Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.
Credit: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pgAdmin 4 | <9.2 | |
| pip/pgadmin4 | <9.2 | 9.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-2945?
CVE-2025-2945 has been classified as a high severity remote code execution vulnerability in pgAdmin 4.
How do I fix CVE-2025-2945?
To fix CVE-2025-2945, it is recommended to upgrade pgAdmin 4 to the latest version that addresses this vulnerability.
Which versions of pgAdmin 4 are affected by CVE-2025-2945?
CVE-2025-2945 affects all versions of pgAdmin 4 prior to 9.2.
What components of pgAdmin 4 are vulnerable in CVE-2025-2945?
CVE-2025-2945 affects the Query Tool and Cloud Deployment modules in pgAdmin 4.
Is remote code execution possible with CVE-2025-2945?
Yes, CVE-2025-2945 allows for remote code execution through specific POST endpoints in pgAdmin 4.
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/weakness
- agent/severity
- agent/references
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-g73c-fw68-pwx3
- alias/CVE-2025-2945
- agent/softwarecombine
- agent/event
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-2946
- agent/source
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/trending
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/nvd-cve
- collector/github-advisory
- vendor/pgadmin
- canonical/pgadmin 4
- package-manager/pip