GitHub Advisoryadvisory · PyPI

GHSA-hp84-p2gq-6fvr SQL injection vulnerability in pgAdmin 4 Maintenance Tool

HIGH Published 2026-05-11 Modified 2026-05-18 Official page ↗
Aliases
CVE-2026-7815
Ecosystem
PyPI
Packages
pgadmin4
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2026-05-18

Affected packages

• PyPI pgadmin4: < 9.15 → fixed in 9.15

Description

SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) were concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command and passed to psql --command. An authenticated user with the tools_maintenance permission could break out of the option syntax and execute arbitrary SQL on the connected PostgreSQL server. The injected SQL could in turn invoke COPY ... TO PROGRAM to escalate to operating-system command execution on the database host. Fix introduces server-side allow-listing of all four fields and switches reindex_tablespace from manual quoting to the qtIdent filter. This issue affects pgAdmin 4: before 9.15.

Related

Alias · CVE (1)

  • CVE-2026-7815 SQL injection vulnerability in pgAdmin 4 Maintenance Tool. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References