CVE-2025-2945

CVE-2025-2945 is a remote code execution vulnerability in pgAdmin 4 that arises from two POST endpoints passing user-controlled parameters directly into Python's eval() function (CWE-94, code injection). An attacker triggers it by sending crafted POST requests to /sqleditor/query_tool/download (query_commited parameter) or /cloud/deploy (high_availability parameter), causing arbitrary Python code to execute under the privileges of the pgAdmin server process. Successful exploitation yields full arbitrary code execution on the host running pgAdmin, consistent with the 8.8 (high) CVSS score; the vector (PR:L, UI:N) indicates a valid low-privileged pgAdmin login is required, with no user interaction needed. All pgAdmin 4 deployments before version 9.2 are affected, including server-mode, Docker, and desktop installations. The issue is not yet in CISA KEV, but a public proof-of-concept exists via the pgAdmin GitHub issue tracker and EPSS estimates a ~54% probability of exploitation within 30 days (99th percentile), so broad scanning and exploitation attempts are likely.

What to do: Upgrade to pgAdmin 4 9.2 or later, which removes the unsafe eval() handling in both endpoints. If upgrading is delayed, restrict network access to the pgAdmin web interface (bind to localhost, VPN, or IP allowlists), ensure authentication is enforced, and audit logs for unusual POST requests to /sqleditor/query_tool/download and /cloud/deploy. Defenders should prioritize patching internet-exposed pgAdmin servers given the public PoC and elevated EPSS score.