CVE-2025-2945
pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules).
The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.
This issue affects pgAdmin 4: before 9.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
pgadmin.org · pgAdmin 4public PoCs found — 5
githubgithub.com/Cycloctane/cve-2025-2945-poc★ 7githubgithub.com/abrewer251/CVE-2025-2945_PgAdmin_PoC★ 3githubgithub.com/ExtremeUday/CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-★ 2githubgithub.com/I3r1h0n/pgAdminOpendoor★ 0githubgithub.com/plur1bu5/CVE-2025-2945-pgadmin-rce★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →