The MASTER_PASSWORD_HOOK setting in pgAdmin 4, used between versions 7.2 and 9.17, expands a %u placeholder with the logged‑in user’s name before executing the resulting command string via subprocess.Popen with shell=True. Because the username can originate from external authentication sources such as OAuth, OIDC claims, Kerberos, or web‑server authentication, an attacker can supply a name containing shell meta‑characters. The original implementation’s direct substitution and shell execution thus allowed arbitrary command execution as the pgAdmin service account, a classic OS command injection (CWE‑78). This fault permits full compromise of the host where pgAdmin runs.

The vulnerable product is pgAdmin 4. Any deployment running versions from 7.2 up to, but not including, 9.17 that uses the MASTER_PASSWORD_HOOK setting with %u substitution is affected. This includes installations that accept user names from external authentication providers such as OAuth, OIDC, Kerberos, or web‑server auth.

With a CVSS score of 7.7 the vulnerability is classified as high severity. The EPSS score of less than 1 % indicates a low expected exploitation probability, and it is not currently listed in the CISA KEV catalogue. Nonetheless, the flaw enables a remote authenticated user to execute arbitrary commands as the pgAdmin service account, delivering catastrophic impact if the hook string is enabled. The attack requires the attacker to be authenticated to pgAdmin and to leverage a configuration that expands %u with an untrusted username.