pgadmin4 is vulnerable to remote code execution. The vulnerability exists in validate_binary_path()
function of __init__.py
due to lack of validation of the binary path which allows an attacker to inject and execute malicious query parameters via the pgAdmin
server.
access.redhat.com/security/cve/cve-2022-4223
bugzilla.redhat.com/show_bug.cgi?id=2151434
github.com/advisories/GHSA-3v6v-2x6p-32mc
github.com/pgadmin-org/pgadmin4/commit/461849c2763e680ed2296bb8a753ca7aef546595
github.com/pgadmin-org/pgadmin4/issues/5593
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5EYTPKHVFSDCETBJI7LBZE4EYHBPN2Q/
lists.fedoraproject.org/archives/list/[email protected]/message/R5EYTPKHVFSDCETBJI7LBZE4EYHBPN2Q/