# CVE-2026-12044: pgAdmin 4: SQL injection in COMMENT ON ... IS '' rendering across dialog templates > Authenticated users can inject SQL via description fields in pgAdmin 4, potentially executing OS commands if the database role has high privileges. - **Severity:** High 8.7 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 18 Jun 2026 - **Updated:** 22 Jun 2026 - **Also known as:** GHSA-hrvw-6gvm-9x99 ## What is CVE-2026-12044? CVE-2026-12044 is a high-severity SQL injection vulnerability in pgadmin.org pgAdmin 4, published on 18 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim. ### Official description SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS ''`` for a user-supplied description field. The Jinja templates for Domains (and their constraints), Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description directly inside a single-quoted SQL literal -- ``'{{ data.description }}'`` -- instead of passing it through the ``qtLiteral`` escape filter. An authenticated pgAdmin user with permission to create or alter the affected object types could submit a description containing an apostrophe, break out of the literal and chain arbitrary SQL. The injected SQL runs under the PostgreSQL role the user is already authenticated as; for a connected role with ``COPY ... TO/FROM PROGRAM`` (typically PostgreSQL superuser), this chains to OS command execution on the PostgreSQL host. The defect does not cross a privilege boundary -- the user already has direct SQL access to that role through pgAdmin's Query Tool -- so the attacker gains no capability beyond what their database role already grants. The marginal impact captures bypass of any application-layer Query Tool gating an operator may have configured. The defect was originally reported against the Domain Dialog ``description`` field; a code-wide audit identified sixteen sites of the same pattern across the templates listed above. The same review also surfaced ten related sinks in the pgstattuple/pgstatindex stats templates -- ``pgstattuple('{{schema}}.{{table}}')`` and the matching pgstatindex shape -- where ``qtIdent`` escapes embedded double quotes inside the identifier but not apostrophes, so a user with CREATE privilege on a schema could plant a table or index named ``foo'bar`` and a later stats viewer would render an unbalanced literal. Fix is layered: 1. Sites: replace every ``'{{ x.description }}'`` with ``{{ x.description|qtLiteral(conn) }}`` (no surrounding quotes -- the filter wraps the value in escaped quotes itself). Plumb ``conn=self.conn`` through every ``render_template`` call that loads one of these templates. Also corrects a ``{ % elif`` Jinja typo in the foreign-table schema diff (dead branch). Rewrite the ten pgstattuple/pgstatindex stats sites to address the relation via OID + ``::oid::regclass`` cast (e.g. ``pgstattuple({{ tid }}::oid::regclass)``), eliminating the embedded literal-call form entirely so that bug-class can no longer recur there. 2. Driver hardening: ``qtLiteral`` (in ``utils/driver/psycopg3/__init__.py``) used to silently return the raw unescaped value when its ``conn`` argument was falsy. It now raises ``ValueError`` -- surfacing the entire bug class going forward. The change immediately uncovered eight latent plumbing bugs (in ``schemas/__init__.py``, ``schemas/functions/__init__.py``, ``schemas/tables/utils.py``, ``foreign_servers/__init__.py``, and seven sites in ``roles/__init__.py``) -- all fixed as part of this patch. The inner ``except`` block that swallowed adapter-level failures and returned the raw value is also removed, so unadaptable inputs raise instead of leaking unescaped values. 3. Regression tests: a per-template behavioural test renders each previously-vulnerable template with an apostrophe-injection payload and asserts the escaped fragment is present and the vulnerable fragment absent; a lint test walks every ``*.sql`` template flagging any ``'{{ ... }}'`` single-quote-wrapped interpolation against an explicit allowlist; unit tests cover the new qtLiteral fail-fast and inner-except raise paths. This issue affects pgAdmin 4: from 1.0 before 9.16. Weakness: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), CWE-116 (Improper Encoding or Escaping of Output) ## Which versions are affected by CVE-2026-12044? It affects 1 product. Products: Pgadmin Pgadmin 4. ## How do I fix CVE-2026-12044? Apply the vendor's patch. ## Is CVE-2026-12044 being exploited? There is no known exploitation of CVE-2026-12044 in the wild and no public exploit code. ## Other vulnerabilities in pgadmin.org pgAdmin 4 - [CVE-2025-2945](https://insights.sbomify.com/CVE-2025-2945/): pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment (critical 9.9) - [CVE-2024-9014](https://insights.sbomify.com/CVE-2024-9014/): OAuth2 client id and secret exposed through the web browser in pgAdmin 4 (critical 9.9) - [CVE-2026-12046](https://insights.sbomify.com/CVE-2026-12046/): Deserialization in pgAdmin 4 (critical 9.5) - [CVE-2026-17351](https://insights.sbomify.com/CVE-2026-17351/): SQL injection in pgAdmin 4 (critical 9.4) - [CVE-2026-17566](https://insights.sbomify.com/CVE-2026-17566/): Command injection in pgAdmin 4 (critical 9.4) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-12044 and fix it if it is affected. What it is: CVE-2026-12044 is a high-severity SQL injection vulnerability in pgadmin.org pgAdmin 4, published on 18 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2026-12044 in the wild and no public exploit code. Affected product: pgadmin.org pgAdmin 4. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-12044/ (Markdown: https://insights.sbomify.com/CVE-2026-12044/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-12044 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-12044 - OSV: https://osv.dev/vulnerability/CVE-2026-12044 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-12044/ Summaries are generated and may contain mistakes; the official description above is the record.