Pgadmin.org - Pgadmin 4 - CRITICAL - CVE-2026-17566. A flaw in the Import/Export Data tool of pgAdmin 4 can allow an attacker to execute arbitrary commands on the PostgreSQL server. This occurs due to improper validation of user-supplied SQL queries that are injected into a Jinja template. The vulnerability results from an error in the parentheses balance checker, which fails to recognize that a backslash before a single quote is treated as an ordinary character when 'standard_conforming_strings' is enabled. This misinterpretation can lead to the acceptance of rogue commands, enabling the execution of malicious actions via the 'TO PROGRAM' clause. As a precaution, the fix implemented rejects any backslash inside single-quoted strings to prevent such command injection.