pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rend…

CVE-2026-17566 is a Remote Code Execution vulnerability in pgAdmin 4's Import/Export Data tool. The vulnerability stems from a flawed parenthesis-balance checker (_is_query_parens_balanced()) that incorrectly handles backslash-escaped single quotes, treating them as if standard_conforming_strings were off, while PostgreSQL defaults it to on since version 9.1. An attacker with the commonly-granted tools_import_export_data permission can craft a SQL query such as SELECT 'a\') TO PROGRAM 'echo pwned' x' that bypasses the checker and injects a TO PROGRAM clause into the psql \copy command, achieving OS-level command execution via popen(). The attack route is POST /import_export/job/<sid> and does not require elevated privileges beyond the standard import/export tool permission. This is related to the same vulnerability class as CVE-2025-12762 and CVE-2025-13780, which also involved psql meta-command injection in pgAdmin. The fix conservatively rejects any backslash inside single-quoted strings in the query validation logic. All versions of pgAdmin 4 prior to 9.18 that introduced _is_query_parens_balanced() are affected.