Executive brief
pgAdmin 4, a popular management tool for PostgreSQL databases, contains a security vulnerability in its cloud deployment module. An attacker with a valid account could provide specially crafted credentials that cause the system to display malicious HTML or scripts to the user. This could be used to redirect users to fraudulent websites or perform unauthorized actions within the management interface.
Technical details
An HTML injection vulnerability exists in pgAdmin 4 versions 6.6 through 9.15 within the cloud deployment module. Multiple endpoints (including /rds/verify_credentials, /azure/, and /google/) fail to sanitize exception text returned by AWS, Azure, and Google SDKs before including it in JSON response bodies. Because the Cloud Wizard frontend uses html-react-parser to render these messages, an attacker can provide a crafted access key containing HTML tags (e.g., <iframe>) that are echoed back in the SDK's error response and executed in the victim's browser. While primarily a self-XSS/injection risk, it could be escalated via CSRF to target other authenticated users. The fix introduces a sanitize_external_text helper to HTML-escape all external SDK and OS exception strings.
Affected products
- PostgreSQL pgAdmin 4 6.6 to 9.15
Timeline
- 2026-06-10: patched: Fix committed to repository
- 2026-06-19: disclosed: CVE published
References
- https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/cloud/__init__.py
- https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/cloud/rds/__init__.py
- https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/cloud/azure/__init__.py
- https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/cloud/google/__init__.py
- https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/cloud/static/js/CloudWizard.jsx
- https://github.com/pgadmin-org/pgadmin4/commit/60d149864b5fdd99675754c7996637737a24fce3
- https://github.com/pgadmin-org/pgadmin4/issues/10069