Vulnerability · Published May 11, 2026 · Assigned by PostgreSQL
CVE-2026-7814pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer
Medium 4.8
In plain English
A medium-severity cross-site scripting in pgAdmin 4 from pgadmin.org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names (database, schema, table, column, etc.) were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any pgAdmin user who navigated to or executed EXPLAIN over the malicious object. Fix replaces innerHTML with textContent. This issue affects pgAdmin 4: before 9.15.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | pgadmin4 | 9.15 | GHSA-6p2c-69cv-3fxq |
| PyPI | pgadmin4 | 9.15 | PYSEC-2026-2866 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pgadmin.org | pgAdmin 4 | 6.9 – before 9.15 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N