{"id":"CVE-2025-2945","aliases":["EUVD-2025-9605","GHSA-g73c-fw68-pwx3","PYSEC-2026-451","openSUSE-SU-2025:14983-1"],"status":"published","title":"pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment","description":"Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).\n\nThe vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.\n\n\nThis issue affects pgAdmin 4: before 9.2.","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.563,"percentile":0.99058,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2025-04-03T12:23:14Z","modified":"2026-10-28T02:31:14Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/pgadmin_query_tool_authenticated","title":"pgAdmin Query Tool authenticated RCE (CVE-2025-2945)","type":"exploit","platform":"Python","date":"2025-04-03","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/pgadmin_query_tool_authenticated"},{"source":"pocgithub","id":"abrewer251/CVE-2025-2945_PgAdmin_PoC","title":"abrewer251/CVE-2025-2945_PgAdmin_PoC","date":"2025-06-03","url":"https://github.com/abrewer251/CVE-2025-2945_PgAdmin_PoC"},{"source":"pocgithub","id":"Cycloctane/cve-2025-2945-poc","title":"Cycloctane/cve-2025-2945-poc","date":"2025-09-13","url":"https://github.com/Cycloctane/cve-2025-2945-poc"},{"source":"pocgithub","id":"I3r1h0n/pgAdminOpendoor","title":"I3r1h0n/pgAdminOpendoor","date":"2025-11-10","url":"https://github.com/I3r1h0n/pgAdminOpendoor"},{"source":"pocgithub","id":"Udayveer17/CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-","title":"Udayveer17/CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-","date":"2025-11-26","url":"https://github.com/Udayveer17/CVE-2025-2945-pgAdmin4-Authenticated-RCE-PoC-"},{"source":"pocgithub","id":"plur1bu5/CVE-2025-2945-pgadmin-rce","title":"plur1bu5/CVE-2025-2945-pgadmin-rce","date":"2026-03-16","url":"https://github.com/plur1bu5/CVE-2025-2945-pgadmin-rce"},{"source":"pocgithub","id":"g0d150ne/CVE-2025-2945","title":"g0d150ne/CVE-2025-2945","date":"2026-08-10","url":"https://github.com/g0d150ne/CVE-2025-2945"},{"source":"pocgithub","id":"Khashayarnzk/CVE-2025-2945-pgAdmin-RCE","title":"Khashayarnzk/CVE-2025-2945-pgAdmin-RCE","date":"2026-08-26","url":"https://github.com/Khashayarnzk/CVE-2025-2945-pgAdmin-RCE"}],"fixes":[{"ecosystem":"PyPI","package":"pgadmin4","fixed_in":["9.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2"}]}],"versions":["4.20","4.22","4.23","4.24","4.25","4.26","4.27","4.28","4.29","4.30","5.0","5.1","5.2","5.3","5.4","5.5","5.6","5.7","6.10","6.11","6.12","6.13","6.14","6.15","6.16","6.17","6.18","6.19","6.2","6.20","6.21","6.3","6.4","6.5","6.6","6.7","6.8","6.9","7.0","7.1","7.2","7.3","7.4","7.5","7.6","7.7","7.8","8.0","8.1","8.10","8.11","8.12","8.13","8.14","8.2","8.3","8.4","8.5","8.6","8.7","8.8","8.9","9.0","9.1"]},{"source":"osv","ecosystem":"PyPI","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2"}]}],"versions":["4.20","4.22","4.23","4.24","4.25","4.26","4.27","4.28","4.29","4.30","5.0","5.1","5.2","5.3","5.4","5.5","5.6","5.7","6.10","6.11","6.12","6.13","6.14","6.15","6.16","6.17","6.18","6.19","6.2","6.20","6.21","6.3","6.4","6.5","6.6","6.7","6.8","6.9","7.0","7.1","7.2","7.3","7.4","7.5","7.6","7.7","7.8","8.0","8.1","8.10","8.11","8.12","8.13","8.14","8.2","8.3","8.4","8.5","8.6","8.7","8.8","8.9","9.0","9.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2-1.1"}]}],"bundled":4}],"products":[{"vendor":"pgadmin","product":"pgadmin_4"},{"vendor":"pgadmin.org","product":"pgadmin 4"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/8603","tags":["issue-tracking","Exploit","Issue Tracking","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2945","tags":["advisory"]},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/75be0bc22d3d8d7620711835db817bd7c021007c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g73c-fw68-pwx3","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2945.json","tags":["advisory"]},{"url":"https://github.com/pgadmin-org/pgadmin4","tags":["package"]},{"url":"https://pypi.org/project/pgadmin4","tags":["package"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BYON52PV4P44MGBG55FDOG2SP2G266ZO/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2946","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-2945","title":"pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment","description":"Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).\n\nThe vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.\n\n\nThis issue affects pgAdmin 4: before 9.2.","status":"published","published":"2025-04-03T12:23:14.792Z","modified":"2026-02-26T18:28:58.124Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:38.351095Z"}],"euvd":[{"id":"EUVD-2025-9605","description":"Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).\n\nThe vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.\n\n\nThis issue affects pgAdmin 4: before 9.2.","status":"published","published":"2025-04-03T12:23:14Z","modified":"2026-02-26T18:28:58Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:16.381292Z"}],"ghsa":[{"id":"GHSA-g73c-fw68-pwx3","title":"pgAdmin 4 Vulnerable to Remote Code Execution","description":"Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).\n\nThe vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.\n\n\nThis issue affects pgAdmin 4: before 9.2.","status":"published","published":"2025-04-03T15:31:13Z","modified":"2025-04-04T14:23:33Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:37.325334Z"}],"nvd":[{"id":"CVE-2025-2945","description":"Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).\n\nThe vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.\n\n\nThis issue affects pgAdmin 4: before 9.2.","status":"published","published":"2025-04-03T13:15:43.24Z","modified":"2026-06-17T09:07:53.883Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:58.094557Z"}],"osv":[{"id":"CVE-2025-2945","title":"pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment","description":"Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).\n\nThe vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.\n\n\nThis issue affects pgAdmin 4: before 9.2.","status":"published","published":"2025-04-03T12:23:14.792Z","modified":"2026-10-28T02:31:14.652961934Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-g73c-fw68-pwx3","title":"pgAdmin 4 Vulnerable to Remote Code Execution","description":"Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).\n\nThe vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.\n\n\nThis issue affects pgAdmin 4: before 9.2.","status":"published","published":"2025-04-03T15:31:13Z","modified":"2026-06-29T12:26:49.916499139Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"PYSEC-2026-451","title":"pgAdmin 4 Vulnerable to Remote Code Execution","description":"Remote Code Execution security vulnerability in pgAdmin 4  (Query Tool and Cloud Deployment modules).\n\nThe vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.\n\n\nThis issue affects pgAdmin 4: before 9.2.","status":"published","published":"2026-06-29T11:50:35.745757Z","modified":"2026-07-01T20:22:59.87906Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"openSUSE-SU-2025:14983-1","title":"pgadmin4-9.2-1.1 on GA media","description":"These are all security issues fixed in the pgadmin4-9.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-10T00:00:00Z","modified":"2026-02-04T03:09:54.490239Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}