CVE-2026-17351 is a bypass of the fix introduced in CVE-2026-12045 for pgAdmin 4 versions 9.13 through 9.16. The vulnerability stems from a disagreement between sqlparse's string-literal lexing and PostgreSQL's own parser under standard_conforming_strings=on. An attacker can craft a payload that sqlparse classifies as a single SELECT statement, while PostgreSQL actually executes it as multiple statements, smuggling a COMMIT to escape the READ ONLY transaction wrapper and enabling write operations or RCE. An initial candidate fix using psycopg's execute(..., prepare=True) was found ineffective because psycopg3 silently falls back to the simple query protocol when prepare_threshold is None, which is pgAdmin's default. The corrected fix sets conn.prepare_threshold=0 on the dedicated read-only connection, forcing the extended query protocol and causing PostgreSQL to reject multi-statement inputs. The attack vector is indirect prompt injection: an attacker plants the malicious payload in any database object the AI Assistant may read, causing the LLM to emit it as a tool call. Affected versions are pgAdmin 4 from 9.13 before 9.17.