CVE-2025-2945 - CVE House
Back to Database
Status published Critical CVE-2025-2945

pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment

Vulnerability Description

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2945

Credits & Attribution

No credits recorded in the NVD database.

References

More from pgadmin.org

View All →
CVE-2025-9636
Cross-Origin Opener Policy Vulnerability in pgAdmin 4
High 7.9
CVE-2025-2946
Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4
Critical 9.1
CVE-2025-13780
Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
Critical 9.1
CVE-2025-12765
pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.
High 7.5
CVE-2025-12764
pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.
High 7.5

Affected Vendor

pgadmin.org

View all reports →

Affected Software

pgAdmin 4
Vulnerable Versions:
0

Timeline

Official Publish: April 3rd, 2025
Last Modified: February 26th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.