CVE-2025-2945
pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
Reported by postgresql · Published April 3, 2025
pgadmin4 is fixed in 9.2 (PyPI)
Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| pgadmin4 | PyPI | 9.2 |
| pgadmin_4 | pgadmin | 9.2 |
| pgAdmin 4 | pgadmin.org | 9.2 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| pgadmin.org | pgAdmin 4 | 0 |
| PyPI | pgadmin4 | 0 |
| pgadmin.org | pgAdmin 4 | 0 |
Timeline
- Apr 3, 2025 CVE Published
- Apr 3, 2025 PoC Published (41 in total, the first dated here)
- Apr 4, 2025 EPSS Score (30 in total, the first dated here)
- May 2, 2025 Coalition ESS Score (30 in total, the first dated here)
- Feb 26, 2026 CVE Updated
- Mar 9, 2026 Security Advisory (3 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-2945
vulnetix vdb fixes CVE-2025-2945Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-2945/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart