CVE-2026-17346

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 1.0 through 9.16 pgAdmin 4 versions 5.0 through 9.16

Description An issue exists where schema, table, publication, and subscription names sourced from pg catalog via the browser tree are not properly escaped. Because PostgreSQL allows arbitrary characters in quoted identifiers, a low-privileged user with permissions to create tables, publications, or subscriptions can use an object name containing an apostrophe to break out of the {{ name }} template interpolation. This occurs when a user, potentially one with higher privileges, opens the Statistics or Dependencies tab of the affected object, leading to arbitrary SQL statement injection within the viewing user's database session.

The affected components include the Index Statistics query for all-indexes listing (coll stats.sql) and the publication and subscription templates (dependencies.sql and get position.sql).

Recommendations Update pgAdmin 4 to version 9.17 or later.