CVE-2026-116241
Description
A flaw was found in pgadmin4. This vulnerability allows an authenticated user to achieve arbitrary code execution on the underlying host running the application. By submitting a specially crafted export query with backslash-escaped quotes in the Import/Export Data feature, an attacker can exploit a quote-parsing discrepancy to escape the command wrapper. Consequently, arbitrary commands can be executed on the host system with the privileges of the operating system account running pgAdmin.
Statement
A flaw was found in pgAdmin 4's Import/Export Data tool where insufficient validation of backslashes inside double-quoted SQL identifiers allows escaping the psql \copy wrapper when standard_conforming_strings is disabled. An authenticated user with standard database role privileges can leverage this mismatch between pgAdmin's parser and psql to inject a TO PROGRAM clause, leading to arbitrary command execution on the host running pgAdmin under the privileges of the pgAdmin operating system user.
Mitigation
Restrict the Import/Export Data feature to trusted administrative accounts within pgAdmin user management, or disable access to the underlying psql binary for the pgAdmin service account where feasible.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate quote-parsing discrepancies by rejecting backslashes inside double-quoted identifiers to prevent escaping pgAdmin's psql copy wrapper into TO PROGRAM shell execution: upgrade to pgAdmin 4 9.19 (or the fixed Pgadmin builds), which reject any backslash encountered inside a double-quoted identifier during query validation, closing all 2 injection vectors (crafted query export containing a backslash inside a double-quoted identifier, TO PROGRAM clause injection in psql \copy wrapper). Until patched, this is a concern on pgAdmin 4 deployments where users have Import/Export Data permissions, so restrict the Import/Export Data feature to trusted administrators, prevent database roles from modifying standard_conforming_strings, or restrict pgAdmin service account execution of the psql binary. As a compensating measure, employ EDR agents to detect and terminate unauthorized child processes or shells spawned by psql, configure auditd to log execve syscalls initiated by psql on the pgAdmin host, and deploy Falco or eBPF runtime security to detect anomalous process execution and shell spawning by pgAdmin or psql accounts. These controls limit blast radius and contain exploitation, but they do not fix the underlying quote-parsing discrepancy defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1312 Argument Injection Prevention (Downstream Input Delimiter Sanitization) (high)
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
