An OS command injection flaw embedded in pgAdmin 4’s Import/Export query export allows an authenticated user to weave shell commands into a psql \copy metacommand. By supplying an input such as ") TO PROGRAM 'cmd'", the attacker can break out of the expected context and run arbitrary programs on the host running pgAdmin, or spawn file writes with ") TO '/path'". The flaw also exists for other fields—format, on_error, log_verbosity—owing to raw interpolation, thereby expanding the attack surface. The vulnerability essentially grants the attacker remote code execution capabilities. The CVE records list this vulnerability as CWE-89.

pgAdmin 4 built prior to version 9.15 from pgadmin.org. All users running these releases should evaluate the severity and plan remediation.

The CVSS score of 8.7 marks the issue as high severity. EPSS data is unavailable, and the vulnerability does not appear in the CISA KEV catalog, implying no publicly confirmed exploits yet. Nevertheless, the flaw requires merely local authentication to pgAdmin, which is typically granted to database administrators. Given the potential for arbitrary code execution or file overwrite on the host, the risk to confidentiality, integrity, and availability is significant.