https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:27:02 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09256 bdu:2026-09256 https://cve.radiocsirt.org/vuln/bdu:2026-09256 https://cve.radiocsirt.org/vuln/euvd-2026-329156 EUVD-2026-329156 https://cve.radiocsirt.org/vuln/euvd-2026-329156 https://cve.radiocsirt.org/vuln/fkie_cve-2026-12045 <p>Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user&#39;s database role.</p> <p>The AI Assistant&#39;s execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to the database driver without restriction to a single statement or to read-only verbs, so a multi-statement payload beginning with COMMIT, END, ROLLBACK, or ABORT terminated the read-only transaction and ran subsequent statements in autocommit mode. The trailing ROLLBACK then had no effect.</p> <p>Delivery is via prompt injection: an attacker who can write content into any object the AI Assistant may inspect (a row, a column value, a comment) can cause the LLM to emit the multi-statement payload as a tool call. With ordinary write privileges on the pgAdmin user&#39;s role the attacker can perform unauthorised data modification. When the pgAdmin user&#39;s role is a PostgreSQL superuser or holds pg_execute_server_program, the chain extends to remote code execution on the database server host via COPY ... TO PROGRAM.</p> <p>Fix validates the LLM-supplied query up front: it must parse to exactly one non-empty / non-comment statement whose leading real token (after stripping whitespace, comments, and punctuation) is one of SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control verbs, DML, DDL, C…</p> <p>Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user&#39;s database role.</p> <p>The AI Assistant&#39;s execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to the database driver without restriction to a single statement or to read-only verbs, so a multi-statement payload beginning with COMMIT, END, ROLLBACK, or ABORT terminated the read-only transaction and ran subsequent statements in autocommit mode. The trailing ROLLBACK then had no effect.</p> <p>Delivery is via prompt injection: an attacker who can write content into any object the AI Assistant may inspect (a row, a column value, a comment) can cause the LLM to emit the multi-statement payload as a tool call. With ordinary write privileges on the pgAdmin user&#39;s role the attacker can perform unauthorised data modification. When the pgAdmin user&#39;s role is a PostgreSQL superuser or holds pg_execute_server_program, the chain extends to remote code execution on the database server host via COPY ... TO PROGRAM.</p> <p>Fix validates the LLM-supplied query up front: it must parse to exactly one non-empty / non-comment statement whose leading real token (after stripping whitespace, comments, and punctuation) is one of SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control verbs, DML, DDL, C…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-12045 https://cve.radiocsirt.org/vuln/ghsa-95q2-vx3p-f723 <p>Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user&#39;s database role.</p> <p>The AI Assistant&#39;s execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to the database driver without restriction to a single statement or to read-only verbs, so a multi-statement payload beginning with COMMIT, END, ROLLBACK, or ABORT terminated the read-only transaction and ran subsequent statements in autocommit mode. The trailing ROLLBACK then had no effect.</p> <p>Delivery is via prompt injection: an attacker who can write content into any object the AI Assistant may inspect (a row, a column value, a comment) can cause the LLM to emit the multi-statement payload as a tool call. With ordinary write privileges on the pgAdmin user&#39;s role the attacker can perform unauthorised data modification. When the pgAdmin user&#39;s role is a PostgreSQL superuser or holds pg_execute_server_program, the chain extends to remote code execution on the database server host via COPY ... TO PROGRAM.</p> <p>Fix validates the LLM-supplied query up front: it must parse to exactly one non-empty / non-comment statement whose leading real token (after stripping whitespace, comments, and punctuation) is one of SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control verbs, DML, DDL, C…</p> <p>Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user&#39;s database role.</p> <p>The AI Assistant&#39;s execute_sql_query tool runs LLM-generated SQL inside a BEGIN TRANSACTION READ ONLY wrapper to prevent data modification. The LLM-supplied query was forwarded to the database driver without restriction to a single statement or to read-only verbs, so a multi-statement payload beginning with COMMIT, END, ROLLBACK, or ABORT terminated the read-only transaction and ran subsequent statements in autocommit mode. The trailing ROLLBACK then had no effect.</p> <p>Delivery is via prompt injection: an attacker who can write content into any object the AI Assistant may inspect (a row, a column value, a comment) can cause the LLM to emit the multi-statement payload as a tool call. With ordinary write privileges on the pgAdmin user&#39;s role the attacker can perform unauthorised data modification. When the pgAdmin user&#39;s role is a PostgreSQL superuser or holds pg_execute_server_program, the chain extends to remote code execution on the database server host via COPY ... TO PROGRAM.</p> <p>Fix validates the LLM-supplied query up front: it must parse to exactly one non-empty / non-comment statement whose leading real token (after stripping whitespace, comments, and punctuation) is one of SELECT, WITH, EXPLAIN, SHOW, VALUES, or TABLE. Transaction-control verbs, DML, DDL, C…</p> https://cve.radiocsirt.org/vuln/ghsa-95q2-vx3p-f723 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11508-1 <p>pgadmin4-9.17-1.1 on GA media</p> <p>pgadmin4-9.17-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11508-1 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2005 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um beliebigen Code mit Benutzer- oder Administratorrechten auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um beliebigen Code mit Benutzer- oder Administratorrechten auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2005