CVE-2026-17351

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 9.13 through 9.16

Description An issue exists where the AI Assistant's execute sql query tool fails to properly validate queries supplied by a Large Language Model (LLM). The tool uses sqlparse to ensure only one non-transaction-control statement is executed within a read-only transaction. However, a discrepancy between how sqlparse and PostgreSQL handle string-literal lexing allows an attacker to smuggle multiple statements. By using a backslash before a quote, an attacker can bypass the validator and execute unauthorized commands, such as COMMIT or CREATE TABLE, leading to security restriction bypass, data manipulation, or remote code execution. This is achievable via indirect prompt injection, where a malicious payload is placed in an object that the AI Assistant reads.

Recommendations Update pgAdmin 4 to version 9.17 or later. As a temporary mitigation, restrict the AI Assistant's access to objects that may contain untrusted content to prevent indirect prompt injection.