CVE-2026-12050

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 1.0 through 9.15

Description An issue exists in the named restore point endpoint 'POST /browser/server/restore point/{gid}/{sid}' where the user-supplied value field is interpolated directly into the SQL string using str.format() instead of being passed as a bound parameter. This allows an authenticated user with a connected PostgreSQL session to inject additional SQL statements. The injected code executes under the database role of the authenticated user, meaning it does not cross privilege boundaries. However, this provides an alternative execution path that could bypass application-layer restrictions placed on the Query Tool.

Recommendations Update to version 9.16 or later. As a temporary workaround, restrict access to the 'POST /browser/server/restore point/{gid}/{sid}' endpoint or avoid using the value parameter in this endpoint until the update is applied.