An OS command injection flaw exists in pgAdmin 4’s Import/Export query export process, allowing an attacker to inject malformed \\copy metacommand syntax such as ") TO PROGRAM 'cmd'". The injected payload escaping the \\copy context enables the execution of arbitrary programs on the host where pgAdmin 4 is running, as well as arbitrary file writes using ") TO '/path'". The vulnerability also afflicts other interpolated fields (format, on_error, log_verbosity), extending the potential attack surface.

pgAdmin 4 versions from pgadmin.org before 9.15 are impacted. Any system running a pre‑9.15 build of pgAdmin 4 should evaluate the risk, as the flaw can be exploited by users with authentication to the pgAdmin web interface.

The CVSS score of 8.7 classifies the issue as high severity, while the EPSS score of < 1% indicates a very low likelihood of exploitation at present and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires an authenticated session to the pgAdmin web interface and is therefore a local privilege escalation for legitimate database administrators. If leveraged, the flaw can compromise confidentiality, integrity, and availability by allowing arbitrary code execution or modification of files on the host running pgAdmin 4.