Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4: before 9.2.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-49d6f62c0e advisory.

    Update to pgadmin-9.2.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of pgAdmin installed on the remote host is prior to 9.2. It is, therefore, affected by the following vulnerabilities:

  - Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The     vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the     query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely     passed to the Python eval() function, allowing arbitrary code execution. (CVE-2025-2945)

  - pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute     any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript     runs on the browser. (CVE-2025-2946)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules). The
    vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the
    query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely
    passed to the Python eval() function, allowing arbitrary code execution. This issue affects pgAdmin 4:
    before 9.2. (CVE-2025-2945)

ID	Name	Product	Family	Severity
234900	Fedora 41 : pgadmin4 (2025-49d6f62c0e)	Nessus	Fedora Local Security Checks	medium
234350	pgAdmin < 9.2 Multiple Vulnerabilities	Nessus	Databases	critical
424761	SCA: security update for pgadmin4 (GHSA-g73c-fw68-pwx3)	Tenable Cloud Security	SCA Checks	high
424761	SCA: security update for pgadmin4 (GHSA-g73c-fw68-pwx3)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2025-2945

high

Tenable Plugins

medium

critical

high

high