J3Seer

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions 1.0 through 9.15 **Description** SQL injection is possible across multiple dialog templates that render descriptions for Domains, Foreign Tables, Languages, and Event Triggers, as well as the Views OID-lookup query. The issue occurs because user-supplied description fields are interpolated directly into single-quoted SQL literals instead of using the `qtLiteral` escape filter. An authenticated user with permissions to create or alter these objects can submit a description containing an apostrophe to execute arbitrary SQL. If the connected role has `COPY ... TO/FROM PROGRAM` permissions (typically a superuser), this can lead to OS command execution on the PostgreSQL host. Additionally, the `pgstattuple` and `pgstatindex` stats templates are affected because `qtIdent` does not escape apostrophes, allowing a user with CREATE privilege on a schema to trigger an unbalanced literal by naming a table or index with an apostrophe. **Recommendations** Update pgAdmin 4 to version 9.16 or later.

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions prior to 9.15 **Description** Local file inclusion (LFI) and server-side request forgery (SSRF) issues exist in the LLM API configuration endpoints. Authenticated users can read arbitrary server-side files by providing a path to the `api key file` preference, or force the application to make requests to internal targets, such as cloud metadata services, by manipulating the `api url` preference. These issues are exploitable via the chat path and model-list endpoints. **Recommendations** Update to version 9.15 or later. Restrict the `api url` using the `config.ALLOWED LLM API URLS` allow-list at every entry point.

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions prior to 9.15 **Description** An SQL injection exists in the Maintenance Tool where four user-supplied JSON fields—`buffer usage limit`, `vacuum parallel`, `vacuum index cleanup`, and `reindex tablespace`—are concatenated directly into the rendered VACUUM, ANALYZE, or REINDEX command and passed to psql --command. An authenticated user with the tools maintenance permission can break out of the option syntax to execute arbitrary SQL on the connected PostgreSQL server. This can further lead to operating-system command execution on the database host by invoking the COPY ... TO PROGRAM command. **Recommendations** Update to version 9.15 or later.