CVE-2026-7816: pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout

Vulnerability summary

CVE-2026-7816 is a high (CVSS 8.8) vulnerability in pgadmin pgadmin_4. EPSS estimates a 1.44% chance of exploitation in the next 30 days, higher than 73.2% of scored vulnerabilities.

Timeline

1. 11-05-2026
   PublishedVulnerability first disclosed.
2. 26-05-2026
   Last modifiedVulnerability information updated.

Description

OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a psql \copy metacommand template without sanitization. An authenticated user could inject ") TO PROGRAM 'cmd'" to break out of the \copy (...) context and achieve arbitrary command execution on the pgAdmin server, or ") TO '/path'" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable. Fix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks. This issue affects pgAdmin 4: before 9.15.

• CWE-78Improper Neutralization of Special Elements used in an OS CommandThe product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.