This vulnerability allows attacker‑supplied PostgreSQL object names to be embedded directly into web page HTML via innerHTML. When a user opens the Browser Tree or executes an EXPLAIN on a malicious object, the browser runs the injected JavaScript, enabling session hijacking, cookie theft, or defacement. The weakness is a classic stored XSS (CWE‑79), affecting confidentiality, integrity, and user trust.

vulnerable builds of pgAdmin 4 earlier than version 9.15 distributed by pgadmin.org, applicable to any installation using the Browser Tree or Explain Visualizer features.

With a CVSS score of 4.8 the issue is moderate; no EPSS data is available and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to create a malicious object name in a database that the target user has access to, and the target must open or examine that object within pgAdmin. The attack vector is user interaction with the application, not remote code execution.