CVE-2026-17347

The CVE describes an OS command injection in pgAdmin 4: a MASTER_PASSWORD_HOOK setting allows an administrator to configure an external command containing %u, which substitutes the current user name (potentially from external sources) into the command string. Previously this could be injected int...