PT-2026-50813 · Pgadmin 4+1 · Pgadmin 4+1
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
pgAdmin 4 versions 6.6 through 9.15
Description
HTML injection is possible in the cloud deployment module. The application propagates exception text from AWS, Azure, and Google SDKs, as well as file-resolution and database-commit exceptions, into JSON response bodies within the
info and errormsg fields without HTML-encoding. The Cloud Wizard frontend renders these strings using html-react-parser, allowing structural HTML to be embedded directly into the DOM.Technical details include the following affected endpoints:
- '/rds/verify credentials/'
- '/rds/deploy'
- '/rds/regions'
- '/rds/update-server'
- '/azure/verify credentials'
- '/azure/deploy'
- '/azure/regions'
- '/azure/update-server'
- '/azure/check cluster name availability'
- '/google/verify credentials'
- '/google/deploy'
- '/google/regions'
- '/google/update-server'
- '/google/verification ack'
- '/google/projects'
- '/google/instance types'
- '/google/database versions'
- '/cloud/deploy'
- '/cloud/update cloud server'
An attacker can use the
access key variable to submit a crafted payload. For example, providing a value containing an iframe can lead to the browser fetching content from an attacker-controlled host and redirecting the victim's tab. This injection occurs within the pgAdmin interface, bypassing X-Frame-Options and Content-Security-Policy frame-ancestors.Recommendations
Update pgAdmin 4 to version 9.16.
Exploit
Fix
DoS
XSS
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pgadmin
Pgadmin 4