GHSA-2rrx-pphc-qfv9

pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-2946

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pgadmin4	< 9.2	9.2

Details

As written in the advisory (Markdown source, shown as plain text).

pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-2946 advisory
https://github.com/pgadmin-org/pgadmin4/issues/8602 web
https://github.com/pgadmin-org/pgadmin4/commit/1305d9910beefd0d6b4c7eb4f111f86edb1d356b web
https://github.com/pgadmin-org/pgadmin4 package