{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-17351 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-17351 is a critical SQL injection vulnerability in pgadmin.org pgAdmin 4, published on 31 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-17351 and fix it if it is affected.\n\nWhat it is: CVE-2026-17351 is a critical SQL injection vulnerability in pgadmin.org pgAdmin 4, published on 31 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-17351 in the wild and no public exploit code.\n\nAffected product: pgadmin.org pgAdmin 4. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-17351/ (Markdown: https://insights.sbomify.com/CVE-2026-17351/index.md)","id":"CVE-2026-17351","markdown":"https://insights.sbomify.com/CVE-2026-17351/index.md","name":"CVE-2026-17351","record":{"aliases":["GHSA-v5gm-27gp-4f7w"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["code_execution","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"pgAdmin 4","requires_auth":"low_privilege","summary":"Attackers can bypass read-only transaction restrictions in pgAdmin 4's AI Assistant via SQL injection, enabling arbitrary code execution and data modification.","user_interaction":"required","vuln_class":"sql_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"PostgreSQL","cpe":[{"product":"pgadmin_4","vendor":"pgadmin"}],"cvss":{"score":9.4,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","version":"4.0"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"},{"id":"CWE-115","name":"Misinterpretation of Input"}],"description":"The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing can disagree with PostgreSQL's own parser: under standard_conforming_strings = on (PostgreSQL's default since 9.1), a backslash immediately before a quote is an ordinary character to PostgreSQL, but sqlparse treats it as escaping the quote. A payload such as SELECT '\\';COMMIT;CREATE TABLE pwn(x int);SELECT 1 --' therefore parses as a single SELECT to sqlparse's validator, while PostgreSQL executes it as four statements: the smuggled COMMIT ends the wrapping read-only transaction, and the trailing ROLLBACK becomes a no-op. This reintroduces the same write/RCE bypass CVE-2026-12045 was meant to close, reachable via the same indirect prompt-injection delivery (an attacker plants the payload in any object the AI Assistant may read; the LLM emits it as a tool call).\n\nAn initial candidate fix ran the query with psycopg's execute(..., prepare=True), intending to force PostgreSQL's own Parse step (extended query protocol) to reject multi-statement text regardless of sqlparse's classification. This candidate fix does not work as submitted: psycopg3's PrepareManager silently ignores the prepare argument whenever the connection's prepare_threshold is None, which is pgAdmin's default for every server connection (the per-server \"Prepare threshold\" field is blank unless an administrator explicitly sets it) -- psycopg3 falls back to the simple query protocol, the same multi-statement-capable path the bypass exploits, so the candidate fix closes nothing on any real-world default configuration.\n\nThe corrected fix sets conn.prepare_threshold = 0 directly on the dedicated, single-use read-only connection the AI Assistant tool opens, structurally forcing the extended query protocol independent of any server-level configuration. Verified against a live PostgreSQL 18 instance: the payload executes successfully under the prepare_threshold=None (default) behavior, and is rejected with \"cannot insert multiple commands into a prepared statement\" once prepare_threshold=0 is set on that connection.\n\nThis issue affects pgAdmin 4: from 9.13 before 9.17.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-07-31","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-07-31T17:17:15Z","kind":"github_poc","ref":"https://github.com/Hunt-Benito/pgadmin-ai-assistant-sql-injection-cve-2026-17351-lexer-differential-bypass","stars":0,"title":null}],"tier":"poc_unverified"},"has_fix":true,"headline":"SQL injection in pgAdmin 4","id":"CVE-2026-17351","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"sql_injection","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"This Power System update is being released to address","id":"CVE-2026-17413"},"packages":[],"prev":{"headline":"pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers","id":"CVE-2026-17350"},"products":["pgAdmin 4"],"published":"2026-07-31","related":[{"cvss_score":9.9,"headline":"pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment","id":"CVE-2025-2945","kev_date_added":null,"published":"2025-04-03"},{"cvss_score":9.9,"headline":"OAuth2 client id and secret exposed through the web browser in pgAdmin 4","id":"CVE-2024-9014","kev_date_added":null,"published":"2024-09-23"},{"cvss_score":9.5,"headline":"Deserialization in pgAdmin 4","id":"CVE-2026-12046","kev_date_added":null,"published":"2026-06-18"},{"cvss_score":9.4,"headline":"Command injection in pgAdmin 4","id":"CVE-2026-17566","kev_date_added":null,"published":"2026-07-31"},{"cvss_score":9.4,"headline":"pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution","id":"CVE-2026-12045","kev_date_added":null,"published":"2026-06-18"},{"cvss_score":9.4,"headline":"pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode","id":"CVE-2026-7813","kev_date_added":null,"published":"2026-05-11"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-01","vendors":["pgadmin.org"]},"summary":"Attackers can bypass read-only transaction restrictions in pgAdmin 4's AI Assistant via SQL injection, enabling arbitrary code execution and data modification.","url":"https://insights.sbomify.com/CVE-2026-17351/"}