THREAT OPS › Threat News › [NVD] CVE-2026-17566 (CRITICAL 9.9) — pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job()
[NVD] CVE-2026-17566 (CRITICAL 9.9) — pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job()
CVE-2026-17566 CVSS: 9.9 CRITICAL Published: 2026-07-31T16:17:00.037
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only b
Indicators of compromise
- CVE-2026-17566cve
- CVE-2025-12762cve
- CVE-2025-13780cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-17566