Adminer versions prior to 5.4.3 improperly neutralize input when generating web pages by embedding unsanitized database server version strings into JavaScript contexts protected by CSP nonces. An attacker who controls a rogue MySQL server can exploit this by returning specially crafted version strings that escape the JavaScript context, enabling arbitrary code execution despite CSP enforcement. This vulnerability is classified as cross-site scripting (XSS) and has a CVSS 4.0 base score of 5.3, indicating medium severity.

An attacker controlling a malicious MySQL server can exploit this vulnerability to execute arbitrary JavaScript code in the context of the Adminer web application. This bypasses Content Security Policy protections intended to prevent such script injection. The impact includes potential compromise of user sessions, data theft, or other client-side attacks within the Adminer interface. However, exploitation requires control over the database server, limiting the attack surface.

No official patch or remediation guidance is currently available. Users should upgrade to Adminer version 5.4.3 or later once released, as the vulnerability affects versions before 5.4.3. Until a fix is available, avoid connecting Adminer to untrusted or potentially malicious MySQL servers. Monitor vendor advisories for updates regarding patches or official mitigations.