Executive brief
pgAdmin is a web-based administration tool for PostgreSQL databases. A flaw in how pgAdmin displays query results allows attackers to inject and execute malicious JavaScript code in users' browsers when they view crafted database records. This could enable attackers to steal session tokens, modify data, or trick users into revealing credentials.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the query result rendering component of pgAdmin 4. When a user executes a SELECT query against a database containing malicious JavaScript payloads (e.g., <img src=a onerror=alert()>), the result grid fails to sanitize or escape HTML/JavaScript content before display, causing the script to execute directly in the user's browser. The attack requires a user to run a query that retrieves attacker-controlled data, but once triggered, it executes with the privileges of the authenticated pgAdmin user. A fix is available in version 9.2.
Affected products
- pgAdmin pgAdmin 4 all versions up to and including 9.1
Timeline
- 2025-04-03: disclosed
- 2025-04-03: patched: fixed in version 9.2