pgAdmin 4 || vulnerable pip modules

From: Rogelio Villafana Sanchez <RVillafana-Sanchez(at)amdocs(dot)com>
To: "pgadmin-support(at)lists(dot)postgresql(dot)org" <pgadmin-support(at)lists(dot)postgresql(dot)org>
Cc: Rogelio Villafana Sanchez <RVillafana-Sanchez(at)amdocs(dot)com>, Akshay Swami <akshaysw(at)amdocs(dot)com>, "Manas (dot)" <Manas(dot)1(at)amdocs(dot)com>
Subject: pgAdmin 4 || vulnerable pip modules
Date: 2026-02-16 19:40:00
Message-ID: VI0PR06MB1016513F4D4341D6DF6A823B3E36CA@VI0PR06MB10165.eurprd06.prod.outlook.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgadmin-support

Hello PGAdmin support team,

Three weeks ago, we completed the upgrade of PGAdmin to v9.11, yet in our last vulnerabilities scan report, several pip modules came in the picture as vulnerable version.
As these are modules which come embedded in the site packages installer, we would like to confirm below question with you.

1. Any existing/coming version that fix shared CVEs?
2. Will it be in their roadmap. If yes when is the plan to fix it?
3. Can we delete those files do we see any impact?
4. We can see v9.12 was just released, but does this version fix the CVEs or have the modules on fixed version?
5. Also, we know these CVEs might be false positive if yes, please share the description.

CVE-2025-68146
CVE-2025-68158
CVE-2025-69277
CVE-2026-0994
CVE-2026-21226
CVE-2026-21441
CVE-2026-21860
CVE-2026-22701
CVE-2026-22702
CVE-2026-23490
CVE-2026-23949
CVE-2026-24049
CVE-2026-26007

Rogelio Villafaña
DevOps Specialist | ATT BSSe
[Shape Description automatically generated with medium confidence]

This email and the information contained herein is proprietary and confidential and subject to the Amdocs Email Terms of Service, which you may review at https://www.amdocs.com/about/email-terms-of-service <https://www.amdocs.com/about/email-terms-of-service>

Attachment Content-Type Size
pgAdmin_vulnerabilities.xlsx application/vnd.openxmlformats-officedocument.spreadsheetml.sheet 18.5 KB

Responses

Browse pgadmin-support by date

  From Date Subject
Next Message Aditya Toshniwal 2026-02-18 05:35:45 Re: pgAdmin 4 || vulnerable pip modules
Previous Message James Rand 2026-02-13 15:54:40 pgAdmin keychain caused by EDB PostgreSQL Mac download