A high severity command injection vulnerability in pgAdmin 4 allows authenticated users to achieve unauthorized code execution on the host system.

The MASTER_PASSWORD_HOOK setting improperly neutralizes special elements used in OS commands, leading to OS command injection and argument injection (CWE-78, CWE-88). This vulnerability requires an attacker to have authenticated access to the pgAdmin 4 application to trigger the flaw.

Successful exploitation allows an authenticated attacker to execute arbitrary commands with the privileges of the pgAdmin 4 process. This could lead to full system compromise, unauthorized data access, and lateral movement within the network. The CVSS score of 7.5 emphasizes the potential for significant security breaches.

Immediate Action: Update pgAdmin 4 to version 9.17 or later to ensure the MASTER_PASSWORD_HOOK is properly secured.

Proactive Monitoring: Audit pgAdmin 4 configuration and access logs for suspicious command execution patterns or unauthorized changes to application settings.

Compensating Controls: Apply strict principle of least privilege for all pgAdmin 4 user accounts and ensure the application runs with the minimum necessary OS permissions.

Public Exploit Available: Unknown

The risk of remote code execution makes this a critical update. Administrators must ensure that their pgAdmin 4 instances are updated to version 9.17 as soon as possible to mitigate the risk of host system compromise.