CVE-2026-12048: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pgadmin.org pgAdmin 4
Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields) was passed verbatim through html-react-parser at every user-facing sink — the notifier toasts, FormFooterMessage / FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser's NodeText panel, the SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text. A PostgreSQL server an attacker controls — or any server returning attacker-influenced text such as a table or column name a low-privilege database user can create — could inject arbitrary HTML (including <iframe>) into the pgAdmin DOM the moment the victim's pgAdmin connected to that server or viewed an Explain plan that referenced the crafted object. The injected iframe's srcdoc could fetch attacker-served JavaScript and, by writing to parent.location, redirect the victim's top-level pgAdmin browser tab to an attacker-controlled URL. Because the injection originates from inside pgAdmin's own interface, standard anti-clickjacking controls (X-Frame-Options, Content-Security-Policy: frame-ancestors) do not mitigate it. A phishing page rendered inside the legitimate pgAdmin window is indistinguishable from a genuine pgAdmin dialog. Fix combines three complementary layers. (1) DOMPurify sanitisation is wrapped around every html-react-parser call site reachable from notifier, alert, form-error, Explain, and SQL-editor flows. (2) A new plain-text rendering contract — SafeMessage / SafeHtmlMessage components plus Notifier.errorText / alertText / warningText / infoText / successText helpers — is introduced; around fifty callers across browser, tools, dashboard, debugger, misc, llm, preferences, schema diff, and the SQL editor that previously interpolated backend-derived strings are migrated to the plain-text variants. (3) Backend HTML-escape is applied at the post-connection-SQL handler (execute_post_connection_sql) via a new sanitize_external_text helper, so third-party JSON consumers (audit logs, API clients) never receive raw markup either; the Explain plan-info renderer is also patched to _.escape Recheck Cond and Exact Heap Blocks at construction (matching every sibling field), giving defence in depth even before DOMPurify runs. This issue affects pgAdmin 4: from 6.0 before 9.16.
AI Analysis
Technical Summary
CVE-2026-12048 is a stored cross-site scripting vulnerability in pgAdmin 4's error-rendering and plan-node-rendering paths. The vulnerability occurs because PostgreSQL server responses, including error messages and explain plan fields, are passed verbatim through html-react-parser into various user interface components without proper sanitization. An attacker controlling a PostgreSQL server or able to influence database object names can inject arbitrary HTML, including iframes, that execute JavaScript and redirect the victim's browser tab within the pgAdmin interface. Standard anti-clickjacking controls do not mitigate this because the injection originates inside the legitimate pgAdmin DOM. The fix includes wrapping all html-react-parser calls with DOMPurify sanitization, introducing safe plain-text rendering components to replace unsafe string interpolations, and applying backend HTML escaping at the SQL handler level to protect third-party JSON consumers. This defense-in-depth approach prevents raw markup from reaching the client and mitigates the XSS risk.
Potential Impact
Successful exploitation allows an attacker controlling a PostgreSQL server or able to influence database object names to inject arbitrary HTML and JavaScript into the pgAdmin 4 interface of a connected user. This can lead to the execution of attacker-supplied scripts, including iframe-based payloads that can redirect the victim's top-level browser tab to attacker-controlled URLs. The vulnerability compromises confidentiality and integrity by enabling phishing attacks and potentially other malicious actions within the trusted pgAdmin interface. The CVSS v3.1 score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality and integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a comprehensive fix involving DOMPurify sanitization on all relevant html-react-parser call sites, introduction of safe plain-text rendering components, and backend HTML escaping to prevent raw markup exposure. Until an official patch or update is released, users should avoid connecting pgAdmin 4 versions from 6.0 up to but not including 9.16 to untrusted PostgreSQL servers or servers that may contain attacker-controlled object names. Monitor the official pgAdmin project advisories for updates and apply patches promptly once available.
CVE-2026-12048: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pgadmin.org pgAdmin 4
Description
Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields) was passed verbatim through html-react-parser at every user-facing sink — the notifier toasts, FormFooterMessage / FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser's NodeText panel, the SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text. A PostgreSQL server an attacker controls — or any server returning attacker-influenced text such as a table or column name a low-privilege database user can create — could inject arbitrary HTML (including <iframe>) into the pgAdmin DOM the moment the victim's pgAdmin connected to that server or viewed an Explain plan that referenced the crafted object. The injected iframe's srcdoc could fetch attacker-served JavaScript and, by writing to parent.location, redirect the victim's top-level pgAdmin browser tab to an attacker-controlled URL. Because the injection originates from inside pgAdmin's own interface, standard anti-clickjacking controls (X-Frame-Options, Content-Security-Policy: frame-ancestors) do not mitigate it. A phishing page rendered inside the legitimate pgAdmin window is indistinguishable from a genuine pgAdmin dialog. Fix combines three complementary layers. (1) DOMPurify sanitisation is wrapped around every html-react-parser call site reachable from notifier, alert, form-error, Explain, and SQL-editor flows. (2) A new plain-text rendering contract — SafeMessage / SafeHtmlMessage components plus Notifier.errorText / alertText / warningText / infoText / successText helpers — is introduced; around fifty callers across browser, tools, dashboard, debugger, misc, llm, preferences, schema diff, and the SQL editor that previously interpolated backend-derived strings are migrated to the plain-text variants. (3) Backend HTML-escape is applied at the post-connection-SQL handler (execute_post_connection_sql) via a new sanitize_external_text helper, so third-party JSON consumers (audit logs, API clients) never receive raw markup either; the Explain plan-info renderer is also patched to _.escape Recheck Cond and Exact Heap Blocks at construction (matching every sibling field), giving defence in depth even before DOMPurify runs. This issue affects pgAdmin 4: from 6.0 before 9.16.
CVSS v3.1
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12048 is a stored cross-site scripting vulnerability in pgAdmin 4's error-rendering and plan-node-rendering paths. The vulnerability occurs because PostgreSQL server responses, including error messages and explain plan fields, are passed verbatim through html-react-parser into various user interface components without proper sanitization. An attacker controlling a PostgreSQL server or able to influence database object names can inject arbitrary HTML, including iframes, that execute JavaScript and redirect the victim's browser tab within the pgAdmin interface. Standard anti-clickjacking controls do not mitigate this because the injection originates inside the legitimate pgAdmin DOM. The fix includes wrapping all html-react-parser calls with DOMPurify sanitization, introducing safe plain-text rendering components to replace unsafe string interpolations, and applying backend HTML escaping at the SQL handler level to protect third-party JSON consumers. This defense-in-depth approach prevents raw markup from reaching the client and mitigates the XSS risk.
Potential Impact
Successful exploitation allows an attacker controlling a PostgreSQL server or able to influence database object names to inject arbitrary HTML and JavaScript into the pgAdmin 4 interface of a connected user. This can lead to the execution of attacker-supplied scripts, including iframe-based payloads that can redirect the victim's top-level browser tab to attacker-controlled URLs. The vulnerability compromises confidentiality and integrity by enabling phishing attacks and potentially other malicious actions within the trusted pgAdmin interface. The CVSS v3.1 score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality and integrity.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has described a comprehensive fix involving DOMPurify sanitization on all relevant html-react-parser call sites, introduction of safe plain-text rendering components, and backend HTML escaping to prevent raw markup exposure. Until an official patch or update is released, users should avoid connecting pgAdmin 4 versions from 6.0 up to but not including 9.16 to untrusted PostgreSQL servers or servers that may contain attacker-controlled object names. Monitor the official pgAdmin project advisories for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PostgreSQL
- Date Reserved
- 2026-06-11T20:40:08.398Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a357432f198dc38c1bc0d3d
Added to database: 06/19/2026, 16:54:10 UTC
Last enriched: 06/26/2026, 19:15:10 UTC
Last updated: 08/03/2026, 07:17:55 UTC
Views: 114
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.