CVE-2025-13780

Name of the Vulnerable Software and Affected Versions pgAdmin versions prior to 9.11

Description pgAdmin 4 is affected by a Remote Code Execution (RCE) issue when running in server mode during the restore of PLAIN-format dump files. The vulnerability exists in the has meta commands() function, which uses a regular expression to detect and block dangerous psql meta-commands (such as !, copy ... PROGRAM, and include) in uploaded SQL files. Attackers can bypass this filter by using specific byte sequences, such as a UTF-8 Byte Order Mark (BOM) at the start of the file or inserting a carriage return (r) between a newline and the backslash. Because the regex does not treat these characters as ignorable, the malicious meta-commands remain undetected. When pgAdmin invokes psql with the --file flag, psql strips these bytes and executes the injected shell commands with the privileges of the pgAdmin process. Approximately 41,200 to 189,900 instances are estimated to be exposed worldwide.

Recommendations Update to version 9.11 or later, which replaces the regex validation with the --restrict flag when launching psql to hardware-block meta-commands.