Chungkn

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions prior to 9.15 **Description** An OS command injection issue exists in the Import/Export query export feature. Authenticated users can exploit this by providing unsanitized input that is interpolated directly into a psql `copy` metacommand template. This allows an attacker to break out of the command context to execute arbitrary commands on the pgAdmin server or perform arbitrary file writes. Additionally, the `format`, `on error`, and `log verbosity` fields are susceptible to raw interpolation and exploitation. **Recommendations** Update to version 9.15 or later. Restrict access to the Import/Export query export feature for authenticated users until the update is applied.