GHSA-xv64-8p4r-94gq

pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload

Source: GitHub Advisory Database (reviewed) High CVE-2024-4216

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pgAdmin4	< 8.6	8.6

Details

As written in the advisory (Markdown source, shown as plain text).

pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-4216 advisory
https://github.com/pgadmin-org/pgadmin4/issues/7282 web
https://github.com/pgadmin-org/pgadmin4/commit/e384c9665ae2e72376be7cefa8e652efcee93767 web
https://github.com/pgadmin-org/pgadmin4 package
https://lists.fedoraproject.org/archives/list/[email protected]/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE web