pgAdmin 4 Command Injection Vulnerability on Windows Systems

A command injection vulnerability has been identified in pgAdmin 4, affecting versions prior to 9.9, on Windows platforms. The issue arises from the use of 'shell=True' during backup and restore processes, which allows attackers to execute arbitrary system commands by crafting specific file path inputs.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of system commands, potentially allowing an attacker to manipulate the system or application in harmful ways.

Remediation

Users can update to pgAdmin 4 version 9.10 or later, where this vulnerability has been fixed.