CVE-2026-7814 Details
Description
Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules. User-controlled PostgreSQL object names (database, schema, table, column, etc.) were assigned to DOM elements via innerHTML, allowing crafted object names containing HTML markup to execute attacker-supplied JavaScript in the browser of any pgAdmin user who navigated to or executed EXPLAIN over the malicious object. Fix replaces innerHTML with textContent. This issue affects pgAdmin 4: before 9.15.
A stored cross-site scripting vulnerability has been identified in pgAdmin 4 versions prior to 9.15. This issue arises in the Browser Tree and Explain Visualizer modules, where user-controlled PostgreSQL object names are assigned to DOM elements using innerHTML. This allows for the execution of attacker-supplied JavaScript in the browsers of pgAdmin users who interact with the malicious objects. The vulnerability has been addressed by replacing innerHTML with textContent.
Users can update to pgAdmin 4 version 9.15 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pgadmin-org/pgadmin4/issues/9865 | CISA-ADP | ExploitIssue TrackingPatchVendor Advisory |
| https://github.com/pgadmin-org/pgadmin4/pull/9865 | PostgreSQL | ExploitIssue TrackingPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| pgadmin pgadmin 4 | >= 6.9, < 9.15 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | PostgreSQL |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | PostgreSQL |