The flaw in pgAdmin 4 permits an attacker to craft a database name containing an equals sign or a PostgreSQL URI; when a materialized view refresh is issued, this name is passed unchanged to psql's --dbname option. libpq interprets such a value as a full connection string, overriding the host, port, and other parameters supplied by pgAdmin. As a result, the refresh process connects to an arbitrary host chosen by the attacker, sending the user’s saved server password to that endpoint and potentially opening additional connections from the pgAdmin host to malicious addresses.

The affected product is pgAdmin 4 from pgadmin.org, in all releases prior to version 9.19, encompassing both the open‑source and commercial editions.

With a CVSS score of 7.1 this vulnerability is considered high severity. The EPSS score is not available and the issue is not listed in CISA KEV, indicating no known widespread exploitation. The attack requires the ability to create a database with a crafted name—a capability that any role possessing the CREATEDB privilege can exercise. By creating such a database, an attacker can entice a legitimate user to perform a materialized view refresh, causing that user's credentials to be transmitted to the attacker‑controlled host and enabling unintended remote connections.