The vulnerability in pgAdmin 4 Maintenance Tool involves four JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) that are concatenated directly into VACUUM/ANALYZE/REINDEX commands passed to psql --command. An authenticated user with tools_maintenance permission can inject SQL to break out of the intended syntax, leading to arbitrary SQL execution on the PostgreSQL server. This can be further leveraged to execute operating system commands on the database host using COPY ... TO PROGRAM. The fix implemented in pgAdmin 4 version 9.15 introduces server-side allow-listing for these fields and changes reindex_tablespace quoting to use the qtIdent filter, mitigating injection risks.

Successful exploitation allows an authenticated user with limited permissions to execute arbitrary SQL commands on the PostgreSQL server, compromising confidentiality, integrity, and availability of the database. Additionally, it enables escalation to operating system command execution on the database host, posing a critical risk to the underlying system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has indicated that the fix is included in pgAdmin 4 version 9.15, which introduces server-side allow-listing and safer quoting to prevent injection. Until patched, restrict access to users with tools_maintenance permission and monitor for suspicious activity related to maintenance commands.