Isaac Chen

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions 9.13 through 9.15 **Description** A read-only transaction bypass exists in the pgAdmin 4 AI Assistant, allowing an attacker who can influence database content read by the assistant to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The `execute sql query()` tool runs LLM-generated SQL within a BEGIN TRANSACTION READ ONLY wrapper. However, because the query was forwarded to the database driver without restricting it to a single statement or read-only verbs, a multi-statement payload starting with COMMIT, END, ROLLBACK, or ABORT can terminate the read-only transaction and execute subsequent statements in autocommit mode. This is achieved via prompt injection, where an attacker writes malicious content into objects the AI Assistant may inspect, such as rows, column values, or comments. This causes the LLM to emit the payload as a tool call. Depending on the user's role, this can lead to unauthorized data modification or, if the user is a PostgreSQL superuser or holds `pg execute server program`, remote code execution on the database server host via COPY ... TO PROGRAM. **Recommendations** Update pgAdmin 4 to version 9.16.