CVE-2026-7814: pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer
Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules.
User-controlled PostgreSQL object names (database, schema, table, column, etc.) were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any pgAdmin user who navigated to or executed EXPLAIN over the malicious object.
Fix replaces innerHTML with textContent.
This issue affects pgAdmin 4: before 9.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgAdmin 4 Browser Tree and Explain Visualizer modulesto a version that resolves this vulnerability.Fixed in 9.15 - Configuration
Modify the rendering logic for user-controlled PostgreSQL object names in the Browser Tree and Explain Visualizer to use textContent instead of innerHTML to prevent stored XSS.
pgAdmin 4 Browser Tree and Explain Visualizer DOM assignment method for PostgreSQL object names = innerHTML -> textContent
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7814?
CVE-2026-7814 is classified as a medium severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2026-7814?
To fix CVE-2026-7814, upgrade pgAdmin 4 to version 9.15 or later where the vulnerability has been addressed.
What components of pgAdmin 4 are affected by CVE-2026-7814?
CVE-2026-7814 affects the Browser Tree and Explain Visualizer modules of pgAdmin 4.
Can CVE-2026-7814 affect user data in pgAdmin 4?
Yes, CVE-2026-7814 can potentially allow attackers to inject malicious scripts that might affect user data by exploiting XSS.
Who is responsible for addressing CVE-2026-7814 in pgAdmin 4?
The pgAdmin Development Team is responsible for addressing CVE-2026-7814 and providing updates to mitigate the vulnerability.