-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists in pgAdmin 4 on Windows systems due to command injection in the backup and restore functionalities. The root cause is the use of shell=True in the subprocess.Popen call within the execute function of the process_executor.py module. This is a generic background process executor used by various parts of pgAdmin, including backup and restore. When a user initiates a backup or restore operation with a specially crafted file path containing shell metacharacters, these characters are interpreted by the Windows shell, leading to arbitrary command execution. The provided patch directly addresses this by setting shell=False for all operating systems, thereby neutralizing the command injection vector. The change in web/pgadmin/tools/restore/__init__.py is related to how file paths are handled before being passed to the execution process, but the core vulnerability lies in the execute function itself, which is the final point of execution for the injected command.
pgadmin.misc.bgprocess.process_executor.executeweb/pgadmin/misc/bgprocess/process_executor.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pgadmin4 | pip | <= 9.9 | 9.10 |
Ongoing coverage of React2Shell