{"id":"CVE-2026-17566","published":"2026-07-31T16:00:22Z","modified":"2026-08-01T03:56:13Z","title":"pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to…","vendor":"pgadmin.org","product":"pgAdmin 4","tier":"tail","description":{"text":"pgAdmin 4's Import/Export Data tool builds a psql \\copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\\') as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql's own \\copy tokenizer treats \\ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT 'a\\') TO PROGRAM 'echo pwned' x' was therefore accepted as \"balanced\" by pgAdmin's checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and treats the following ) as the end of the wrapping \\copy (...) subquery, exposing an attacker-chosen TO PROGRAM '<command>' clause that psql executes via popen() -- independent of a subsequent syntax error later on the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection during PLAIN-format dump restore), reached through an independently written defense in a different module (Import/Export Data rather than Restore) that had its own, different logic bug (inverted backslash-escape semantics rather than a BOM-defeated regex anchor).\n\nThe fix rejects any backslash inside a single-quoted string in the query outright, rather than picking one of the two possible psql interpretations. This is intentionally conservative: because the correct interpretation of \\ depends on the target server's standard_conforming_strings setting, which the checker cannot reliably know at validation time, refusing the query is safer than guessing.\n\nThis issue affects pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00673,"percentile":0.521,"provenance":"source"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"},{"id":"CWE-115","name":"Misinterpretation of Input"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/10213","tags":["issue-tracking"]},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3","tags":["patch"]}],"priority":{"score":22.4,"factors":[{"name":"EPSS percentile","points":10.42},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.93}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-08-04","earliestUrl":"https://github.com/HackSpeak/CVE-2026-17566","repos":[{"name":"HackSpeak/CVE-2026-17566","url":"https://github.com/HackSpeak/CVE-2026-17566","stars":2,"created":"2026-08-04"}]},"first":{"date":"2026-08-04","source":"PoC-in-GitHub","url":"https://github.com/HackSpeak/CVE-2026-17566"},"provenance":"source"},"vendorSlug":"pgadmin-org","affectedVersions":[{"vendor":"pgadmin.org","product":"pgAdmin 4","versions":["< 9.18"]}],"euvd":{"id":"EUVD-2026-51565","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pgadmin-org-pgadmin-4-cve-2022-0959","children":[{"from":"CVE-2026-17566","to":"CVE-2026-116241","relation":"bypass","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"This is a bypass of the fix for CVE-2026-17566.","from":"NVD","in":"CVE-2026-116241"}]}]}}