Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pgadmin-org/pgadmin4

              master @ bc58657
            

Fixes

CVEs

CRITICAL

Peak severity

35.3%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

web/pgadmin/utils/session.py: most-fixed (6 issues). Treat as high-risk during review.

66 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authentication/Authorization Bypass: Multiple fixes show routes and Socket.IO handlers lacking RBAC or login decorators, enabling unauthorized access to tools, servers, and privileged operations.

Command Injection: Subprocess calls with shell=True or unescaped user input in psql templates led to RCE; fixes enforce shell=False, input validation, and meta-command blocking.

SQL Injection: Unescaped object names in SQL templates and missing parameterization allowed injection; fixes use qtLiteral, bound parameters, and allowlists.