CVE-2026-56704: Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adminerto a version that resolves this vulnerability.Fixed in 5.4.3
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Adminer deployments before 5.4.3 are exposed when they connect to a rogue or attacker-controlled MySQL server. The attacker does not need Adminer credentials according to the supplied vector, but a user must interact with the affected Adminer page.
What must an attacker control to exploit this issue?
The attacker must control a MySQL server that Adminer connects to and make it return a crafted server version string. That string can escape the JavaScript context and execute code despite CSP nonces.
Does Content Security Policy prevent exploitation?
No. The issue specifically involves unsanitized content being inserted into script tags carrying valid CSP nonces, allowing the crafted version string to bypass the intended CSP protection.
What version resolves the issue?
Upgrade Adminer to version 5.4.3 or later. Versions before 5.4.3 are affected.