TI-2026-06876 Aliases CVE-2026-7814 GHSA-6p2c-69cv-3fxq

pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer

MEDIUM 55CWE-79Published 2026-05-11 · Updated 2026-05-11

Key facts

Attack vector: Network
Privileges required: High
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names (database, schema, table, column, etc.) were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any pgAdmin user who navigated to or executed EXPLAIN over the malicious object. Fix replaces innerHTML with textContent. This issue affects pgAdmin 4: before 9.15.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00163 5th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Fixed pgAdmin 4 (pgadmin.org): 9.15pgadmin4 (PyPI): 9.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pgadmin.org	pgAdmin 4	6.9 to before 9.15	9.15	Patch available	CNA
—	pgadmin4 (PyPI)	before 9.15	9.15	Patch available	GHSA-6p2c-69cv-3fxq

pgAdmin 4 Vendorpgadmin.org Affected 6.9 to before 9.15 Fixed in 9.15 Patch available CNA
pgadmin4 (PyPI) Vendor— Affected before 9.15 Fixed in 9.15 Patch available GHSA-6p2c-69cv-3fxq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pgadmin:pgadmin_4::::::postgresql::*	6.9 to before 9.15	Vulnerable	pgadmin.org

cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* Versions 6.9 to before 9.15 Vulnerable ·pgadmin.org

Remediation

Fix · CNA pgAdmin 4 (pgadmin.org) Fixed in 9.15
Fix · GHSA-6p2c-69cv-3fxq pgadmin4 (PyPI) Fixed in 9.15 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-05-11
pgadmin.org pgAdmin 4 9.15
8 records Highest priority Priority HIGH 1 HIGH, 3 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2026-06875 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server modePriority HIGH 76
- TI-2026-06878 pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakoutPriority MEDIUM 43
- TI-2026-06877 pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code executionPriority MEDIUM 40
Show all 8 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-7814
2026-10-03 Alias added: GHSA-6p2c-69cv-3fxq

References

Exploit 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-7814

Other 1

https://github.com/pgadmin-org/pgadmin4

TI-2024-01901 Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 CVSS 3.1CRITICAL 9.9
TI-2024-02918 Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 CVSS 3.1CRITICAL 9.8
TI-2022-03867 Code injection in pgadmin4 CVSS 3.1HIGH 8.8
TI-2026-06875 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode CVSS 4.0CRITICAL 9.4
TI-2025-02572 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment CVSS 3.1CRITICAL 9.9
TI-2023-00228 Path traversal in pgadmin CVSS 3.1MEDIUM 6.5

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences