Executive brief
pgAdmin 4 is a popular management tool for PostgreSQL databases. A security vulnerability exists where malicious database object names (like table or column names) can execute unauthorized code in a user's web browser. If an administrator or user views a database containing these specially crafted names, an attacker could potentially steal session information or perform actions on behalf of the user.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Browser Tree and Explain Visualizer modules of pgAdmin 4. The root cause is the use of 'innerHTML' to assign user-controlled PostgreSQL object names (such as databases, schemas, tables, or columns) to DOM elements. An attacker with high privileges (sufficient to create or rename database objects) can inject HTML markup and JavaScript into these names. The payload executes when another user navigates to the malicious object in the browser tree or runs an EXPLAIN command over it. The vulnerability is remediated in version 9.15 by replacing 'innerHTML' with 'textContent' to ensure proper encoding.
Affected products
- PostgreSQL pgAdmin 4 before 9.15
Timeline
- 2026-05-11: disclosed
- 2026-05-11: advisory
- 2026-05-11: patched: Fixed in version 9.15