CVE-2026-12048

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 6.0 through 9.15

Description Stored cross-site scripting exists in the error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server, such as ErrorResponse messages, object names in relation-does-not-exist errors, and EXPLAIN Recheck Cond or Exact Heap Blocks fields, is passed verbatim through html-react-parser at various user-facing sinks. These sinks include notifier toasts, FormFooterMessage, FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser's NodeText panel, SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text.

An attacker controlling a PostgreSQL server, or a low-privilege user capable of creating objects with crafted names, can inject arbitrary HTML, such as <iframe> tags, into the DOM. This occurs when a victim connects to the server or views an Explain plan referencing the crafted object. The injected iframe can execute JavaScript to redirect the user to an attacker-controlled URL. Because the injection occurs within the internal interface, standard anti-clickjacking controls like X-Frame-Options and Content-Security-Policy frame-ancestors are ineffective.

Recommendations Update pgAdmin 4 to version 9.16 or later.