What’s Vulnerable › Vulnerabilities
CVE-2025-2945: pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 56.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-04-03 · updated 2026-06-17
- Weakness: CWE-94
Description
Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.
Affected products
- pgadmin.org pgAdmin 4: before 9.2 — fixed in 9.2
How to fix
Upgrade to a fixed version: pgadmin.org pgAdmin 4 9.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-2945 or the next vulnerability affects your stack