pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering

MEDIUM 6.1CVE-2025-2946 · GHSA-2rrx-pphc-qfv9 · PYSEC-2026-449 · Published 03/04/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
pgadmin4 PyPI	`< 9.2`	`9.2`
pgadmin 4 pgadmin	`≤ 9.1`	No fix yet

Description

pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-2946 · ADVISORY
pgadmin-org/pgadmin4 · WEB
pgadmin-org/pgadmin4 commit 1305d99 · WEB
pgadmin-org/pgadmin4 · PACKAGE
pypi.org/project/pgadmin4 · PACKAGE
GitHub Advisory GHSA-2rrx-pphc-qfv9 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free