pgAdmin 4 Import/Export Data wraps query exports in psql copy (…) TO and checks balanced parentheses, but mishandles backslashes in double-quoted identifiers when standard_conforming_strings is off. An authenticated user with Import/Export Data permission can break out of copy and execute TO PROGRAM on the pgAdmin host as the pgAdmin OS account. Affected: < 9.19; upgrade to 9.19+ to mitigate.