CVE-2026-7814 is a stored XSS vulnerability in pgAdmin 4's Browser Tree and Explain Visualizer modules. It occurs because PostgreSQL object names controlled by users are inserted into the DOM via innerHTML, allowing attackers to inject malicious JavaScript. This can lead to script execution in the context of the pgAdmin user's browser session when they navigate to or run EXPLAIN on the malicious object. The vulnerability affects versions before 9.15, including 6.9. The intended fix replaces innerHTML with textContent to safely render object names as text rather than HTML.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of pgAdmin users who interact with maliciously named PostgreSQL objects. This can lead to information disclosure or other client-side impacts within the context of the pgAdmin web interface. The CVSS score of 4.8 reflects a medium severity with low complexity and requiring user interaction and privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in pgAdmin 4 version 9.15 by replacing innerHTML with textContent. Until an official patch is available, users should avoid interacting with untrusted PostgreSQL objects with potentially malicious names. Monitor pgAdmin.org for updates and apply the official fix once released.