Hello pgAdmin Maintainers, A read-only inspection of our Windows installation found:
- pgAdmin 4: *9.18*, confirmed in web/version.py and the runtime executable metadata - Bundled Python: *3.13.14*, confirmed in the executable and DLL metadata - Python location: C:\Program Files\pgAdmin 4\python\ - Standard library: python313.zip FortiClient reported *CVE-2026-0864*. Static inspection of configparser.pyc found that RawConfigParser._write_section performs the LF-to-LF+TAB replacement without the complete CR/CRLF normalization introduced by the upstream fix. We understand that the advisory concerns configuration injection when an attacker controls written multiline values. We have not demonstrated that this input can reach the affected function through pgAdmin, nor established arbitrary code execution. When checked on *21 October 2026*, the official Windows download page listed *9.18* as the latest stable release. Could you please confirm: 1. Which official Windows package or installer revision includes the corrected Python library? 2. Whether pgAdmin 9.18 has been repackaged with a fix, and how to distinguish that installer from the earlier package. 3. Whether this issue is reachable in desktop or server mode, and whether a supported interim mitigation exists. 4. If a corrected package is pending, which issue or release will track its availability. We would prefer to update through an official pgAdmin package rather than replace the embedded Python installation manually. Thank you. Jubar
