CVE-2025-2945 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
Attackers can execute arbitrary code via unsafe eval() calls in pgAdmin 4 Query Tool and Cloud Deployment modules.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-2945?
CVE-2025-2945 is a critical code injection vulnerability in pgadmin.org pgAdmin 4, published on 3 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules).
The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.
This issue affects pgAdmin 4: before 9.2.
Weakness: CWE-94
Which versions are affected by CVE-2025-2945?
3 open source packages ship an affected version, including pgadmin4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pgadmin4 PyPI | All versions | 9.2 |
pgadmin4 PyPI | All versions | 9.2 |
pgadmin4 PyPI | All versions | 9.2 |
Products include Pgadmin Pgadmin 4.
How do I fix CVE-2025-2945?
Upgrade pgadmin4 to 9.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-2945 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-2945 exists.
Public exploit code: 1 Metasploit module and 7 proofs of concept on GitHub.
Other vulnerabilities in pgadmin.org pgAdmin 4
- CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4
- CVE-2026-12046 Deserialization in pgAdmin 4
- CVE-2026-17351 SQL injection in pgAdmin 4
- CVE-2026-17566 Command injection in pgAdmin 4
- CVE-2026-12045 pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution
Sources
Also known as GHSA-g73c-fw68-pwx3, PYSEC-2026-451.