pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload

MEDIUM 5.4CVE-2024-4216 · GHSA-xv64-8p4r-94gq · PYSEC-2026-1777 · Published 02/05/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
pgadmin4 PyPI	`< 8.6`	`8.6`
pgadmin 4 pgadmin	`< 8.6`	`8.6`

Description

pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.

NVD description

pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script at the client end.

References

nvd.nist.gov/vuln/detail/CVE-2024-4216 · ADVISORY
pgadmin-org/pgadmin4 · WEB
pgadmin-org/pgadmin4 commit e384c96 · WEB
pgadmin-org/pgadmin4 · PACKAGE
lists.fedoraproject.org/archives/list/[email protected]/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/T2YFVCB4HCXU3FQBZ5XTWJZWSZUDNCXE · Mailing List
pypi.org/project/pgadmin4 · PACKAGE
GitHub Advisory GHSA-xv64-8p4r-94gq · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free