Read‑only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user’s database role. The LLM‑generated query is forwarded to the database driver without restricting it to a single statement or to read‑only verbs, so a multi‑statement payload beginning with COMMIT, END, ROLLBACK, or ABORT breaks the read‑only wrapper and runs subsequent statements in autocommit mode, leaving the trailing ROLLBACK ineffective. When the pgAdmin user holds ordinary database privileges, this permits unauthorized data modification; if the user is a superuser or has pg_execute_server_program, the chain extends to remote code execution on the database server through COPY … TO PROGRAM.

This flaw affects pgAdmin 4 distributed by pgadmin.org. The vulnerable code is present in releases starting with version 9.13 up to, but not including, version 9.16. On any installation of those releases that has the AI Assistant enabled and where the attacker can inject data into objects the assistant reads, the vulnerability is exploitable.

The CVSS score of 9.4 classifies the issue as critical, and while the EPSS score is not available, the lack of a CISA KEV listing does not diminish the risk of exploitation. Attackers can reach the AI Assistant through the web interface, performing prompt injection by writing content into rows, columns or comments that the assistant processes. From ordinary write privileges the attacker can alter data, whereas a higher‑privileged pgAdmin user can execute arbitrary shell commands on the database host, making this a serious remote code execution vector with wide impact.