CVE-2026-116241

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.19

Description An ordinary database user can execute operating system commands on the host machine running pgAdmin 4 as the account running the application. This occurs through the Import/Export Data tool, which wraps query exports in a psql copy (...) TO command. A discrepancy between how pgAdmin and psql handle backslashes within double-quoted identifiers allows a user to bypass parentheses balancing checks. By disabling standard conforming strings, a user can hide a closing parenthesis from pgAdmin's validation, allowing the execution of a TO PROGRAM clause on the host system before the server rejects the statement.

Recommendations Update to version 9.19 or later.