A critical OS command injection vulnerability in pgAdmin 4 permits authenticated users to execute arbitrary commands, leading to full system compromise.

The vulnerability stems from improper validation of SQL queries within the Import/Export tool, where backslash characters are misinterpreted during template rendering. An authenticated user with standard import/export permissions can inject an arbitrary TO PROGRAM clause to achieve OS command execution.

This flaw allows an attacker to gain remote code execution on the server hosting pgAdmin 4. With a CVSS score of 9.9, the impact is total, potentially leading to unauthorized access to the entire server, data theft, and the installation of persistent malicious software.

Immediate Action: Update pgAdmin 4 to version 9.18 or later to incorporate the more conservative and secure input validation logic.

Proactive Monitoring: Review system logs for suspicious process spawning or unexpected commands originating from the pgAdmin service account.

Compensating Controls: Restrict access to the pgAdmin 4 interface to authorized personnel using VPN or network-level access controls to minimize the number of users capable of triggering the vulnerable function.

Public Exploit Available: Unknown

Organizations running pgAdmin 4 must treat this as a high-priority security update. Given the severity of remote code execution, immediate patching to version 9.18 is the only definitive way to eliminate the risk of host compromise.