GitHub Advisoryadvisory · PyPI

GHSA-2rrx-pphc-qfv9 pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering

CRITICAL Published 2025-04-03 Modified 2025-04-04 Official page ↗
Aliases
CVE-2025-2946
Ecosystem
PyPI
Packages
pgadmin4
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
Weaknesses
CWE-79
Reviewed
2025-04-04

Affected packages

• PyPI pgadmin4: < 9.2 → fixed in 9.2

Description

pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.

Related

Alias · CVE (1)

  • CVE-2025-2946 pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References