pgAdmin 4: OS command injection via backslash in Import/Export Data query export
Summary
pgAdmin 4 before 9.19 wraps query exports of the Import/Export Data tool in a psql copy command and validates the parentheses. A backslash inside a double-quoted identifier is not rejected, so a crafted query can hide a closing parenthesis from the check and run a TO PROGRAM clause through psql on the pgAdmin host. This bypasses the earlier fix CVE-2026-17566. The attacker needs a pgAdmin login with the Import/Export Data permission, which is granted to non-administrators by default, and can set standard_conforming_strings to off for their own database role.
Affected
- pgAdmin 4 before 9.19 (CVE record: 0 to less than 9.19)
- Default configuration is unaffected according to the CNA record, which refers to the Import/Export Data tool.
Fixed in
- pgAdmin 4 9.19 or later (the fix commit rejects any backslash inside a double-quoted identifier)
Workaround
Unknown.
- Interim measure from third-party sources for the predecessor CVE-2026-17566: revoke the Import/Export Data permission (tools_import_export_data) from roles that do not need it. This is not a vendor recommendation.
Exploitation
- OffSeq lists the CVE as not known to be exploited. No CISA KEV listing or vendor statement of in-the-wild exploitation was found.
- No public proof of concept specific to this CVE was found. The predecessor CVE-2026-17566 has public proof-of-concept code.
Our recommendation
- Upgrade pgAdmin 4 to version 9.19 or later on all desktop and server installations.
- Until the upgrade is done, revoke the Import/Export Data permission from users who do not need it.
- Run pgAdmin with least privilege and limit its filesystem and network access.
- Review Import/Export job logs for unexpected query exports.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit 9be31a0 (pgAdmin 4) github.com
- pgAdmin 4 issue 10663 (internal tracking for 9.19) github.com
- pgAdmin homepage www.pgadmin.org
- pgAdmin 4 9.19 release notes www.pgadmin.org
- OffSeq threat radar entry for CVE-2026-116241 radar.offseq.com
- Strix CVE entry for CVE-2026-116241 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:36.
Original description (NVD)
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, where it treated the next double quote as closing the identifier. psql's \copy parser applies the connection's escape character to whichever quote opened a token, so with standard_conforming_strings off a backslash-escaped double quote does not close the identifier. pgAdmin's and psql's view of the quoting then diverged, a closing parenthesis hidden from the check ended the \copy (...) wrapper, and a following TO PROGRAM clause was executed by psql on the pgAdmin host, as the operating-system account running pgAdmin, before the server rejected the statement. An ordinary database role can turn standard_conforming_strings off for itself, and the Import/Export Data permission is granted to non-administrators by default. This is a bypass of the fix for CVE-2026-17566. The fix rejects any backslash inside a double-quoted identifier, as was already done for single-quoted strings, since its meaning depends on a server setting that cannot be known reliably when the query is validated. This issue affects pgAdmin 4: before 9.19.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.