pgAdmin 4 AI Assistant — sqlparse Lexing Bypass Reintroduces LLM-Query-Injection SQL Execution Outside Read-Only Wrapper

NVD published CVE-2026-17351 (CVSS 9.0, Critical) on 2026-07-31, describing a bypass of the read-only transaction safeguard that was specifically built to constrain the pgAdmin AI Assistant's LLM-driven SQL execution tool.

This is a direct case of an LLM-tool safety control (a read-only wrapper meant to constrain AI-generated SQL) being defeated via a parser confusion bug — demonstrating that guardrails built around LLM tool-calling need to be as rigorously tested as the underlying attack surface itself, since a single lexing edge case reopens full unrestricted SQL execution from AI-generated queries against production databases.

The prior fix for CVE-2026-12045 required LLM-supplied queries passed to the AI Assistant's execute_sql_query tool to parse via sqlparse as exactly one non-transaction-control statement before running inside a BEGIN TRANSACTION READ ONLY wrapper; sqlparse's string-literal lexing can be tricked (e.g. via crafted string literals) into misparsing a multi-statement payload as a single statement, allowing an LLM-influenced or prompt-injected query to break out of the read-only transaction wrapper and execute arbitrary SQL.

pgAdmin 4 (fix regression on top of CVE-2026-12045, affecting 9.16 and related versions)

Apply the patch referenced in the pgAdmin4 GitHub commit (bf4792444446f0e7ab721d23cbd6bfe6afaa7a8b); review AI Assistant tool-call sanitization logic beyond sqlparse-based validation.