pgAdmin 4 CVE-2026-7816: OS Command Injection via Query Export

The National Vulnerability Database has detailed CVE-2026-7816, a critical OS command injection vulnerability (CWE-78) affecting pgAdmin 4 versions prior to 9.15. This flaw resides in the Import/Export query export functionality, where user-supplied input was directly interpolated into psql \copy metacommand templates without proper sanitization. This is a classic injection scenario, ripe for abuse.

An authenticated attacker could exploit this by injecting ") TO PROGRAM 'cmd'" to break out of the \copy (...) context, leading to arbitrary command execution on the pgAdmin server. Alternatively, ") TO '/path'" could facilitate arbitrary file writes. The National Vulnerability Database notes that additional fields such as format, on_error, and log_verbosity were also vulnerable to raw interpolation, expanding the attack surface.

To remediate this, pgAdmin 4 versions 9.15 and later implement a parens-balance parser, modeled after psql’s strtokx tokenizer. The fix also allow-lists format, on_error, and log_verbosity parameters, rejects null bytes in queries, and tightens type and gating checks. This is a high-severity vulnerability with a CVSS score of 8.8, underscoring the immediate risk to affected environments.