Thiago Pereira

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions 7.2 through 9.16 **Description** An issue exists in the `MASTER PASSWORD HOOK` setting where the application substitutes the username directly into a command string and executes it using `subprocess.Popen(..., shell=True)`. Since usernames can originate from external authentication sources like OAuth/OIDC claims, Kerberos, or webserver auth, an authenticated user with a username containing shell metacharacters (such as `;`, `$()`, backticks, pipes, `&&`, or newlines) can execute arbitrary commands as the pgAdmin service account. **Recommendations** Update pgAdmin 4 to version 9.17 or later. For administrators who used shell features like pipes, redirection, environment-variable expansion, or globbing within the `MASTER PASSWORD HOOK` string, move that logic into the invoked script.