CVE-2026-7814

pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer

Published May 11, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Description

Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules.

User-controlled PostgreSQL object names (database, schema, table, column, etc.) were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any pgAdmin user who navigated to or executed EXPLAIN over the malicious object.

Fix replaces innerHTML with textContent.

This issue affects pgAdmin 4: before 9.15.

Analysis

Technical impact

This vulnerability allows attacker‑supplied PostgreSQL object names to be embedded directly into web page HTML via innerHTML. When a user opens the Browser Tree or executes an EXPLAIN on a malicious object, the browser runs the injected JavaScript, enabling session hijacking, cookie theft, or defacement. The weakness is a classic stored XSS (CWE‑79), affecting confidentiality, integrity, and user trust.

Affected Systems

vulnerable builds of pgAdmin 4 earlier than version 9.15 distributed by pgadmin.org, applicable to any installation using the Browser Tree or Explain Visualizer features.

Risk and Exploitability

With a CVSS score of 4.8 the issue is moderate; no EPSS data is available and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to create a malicious object name in a database that the target user has access to, and the target must open or examine that object within pgAdmin. The attack vector is user interaction with the application, not remote code execution.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pgadmin.org

pgAdmin 4

affected

Version	Status	Constraints
`6.9`	affected	< 9.15

Configuration 1 [-]

cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*

No data.

Vendor Product Versions

Pgadmin

Pgadmin 4

Version	Status	Scheme	Platform
`[6.9,9.15)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade pgAdmin 4 to version 9.15 or later to apply the fix that replaces innerHTML with textContent.
If upgrading immediately is not possible, disallow or sanitize object names containing HTML markup before they are rendered, or configure the application to use textContent in all DOM assignments.
Restrict database users from creating or naming objects with potentially harmful characters, and monitor logs for unusual object names that could trigger XSS.

Generated by OpenCVE AI on May 11, 2026 at 17:01 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-6p2c-69cv-3fxq	pgAdmin 4: Stored cross-site scripting (XSS) vulnerability in Browser Tree and Explain Visualizer modules

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.163% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/pgadmin-org/pgadmin4/issues/9865
https://github.com/pgadmin-org/pgadmin4/pull/9865

History

May 26, 2026 2:00 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:pgadmin:pgadmin_4::::::postgresql::*

May 12, 2026 9:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Pgadmin Pgadmin pgadmin 4
Vendors & Products		Pgadmin Pgadmin pgadmin 4

May 11, 2026 6:30 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://github.com/pgadmin-org/pgadmin4/issues/9865
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 11, 2026 5:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-79

May 11, 2026 3:30 PM Description updated. Title updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names (database, schema, table, column, etc.) were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any pgAdmin user who navigated to or executed EXPLAIN over the malicious object. Fix replaces innerHTML with textContent. This issue affects pgAdmin 4: before 9.15.
Title		pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer
References		https://github.com/pgadmin-org/pgadmin4/pull/9865
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'}` cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}`