title: Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4
description: pgAdmin <= 8.4 is affected by a  Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.
affected:
{
defaultStatus: affected
modules: Utility's Binary Path
product: pgAdmin 4
programFiles: https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/__init__.py
repo: https://github.com/pgadmin-org/pgadmin4
vendor: pgadmin.org
versions:
lessThan: 8.5, status: affected, version: 0, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL