Upstream information

CVE-2026-12048 at MITRE

Description

Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields) was passed verbatim through html-react-parser at every user-facing sink - the notifier toasts, FormFooterMessage / FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser's NodeText panel, the SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text. A PostgreSQL server an attacker controls - or any server returning attacker-influenced text such as a table or column name a low-privilege database user can create - could inject arbitrary HTML (including <iframe>) into the pgAdmin DOM the moment the victim's pgAdmin connected to that server or viewed an Explain plan that referenced the crafted object.

The injected iframe's srcdoc could fetch attacker-served JavaScript and, by writing to parent.location, redirect the victim's top-level pgAdmin browser tab to an attacker-controlled URL. Because the injection originates from inside pgAdmin's own interface, standard anti-clickjacking controls (X-Frame-Options, Content-Security-Policy: frame-ancestors) do not mitigate it. A phishing page rendered inside the legitimate pgAdmin window is indistinguishable from a genuine pgAdmin dialog.

Fix combines three complementary layers. (1) DOMPurify sanitisation is wrapped around every html-react-parser call site reachable from notifier, alert, form-error, Explain, and SQL-editor flows. (2) A new plain-text rendering contract - SafeMessage / SafeHtmlMessage components plus Notifier.errorText / alertText / warningText / infoText / successText helpers - is introduced; around fifty callers across browser, tools, dashboard, debugger, misc, llm, preferences, schema diff, and the SQL editor that previously interpolated backend-derived strings are migrated to the plain-text variants. (3) Backend HTML-escape is applied at the post-connection-SQL handler (execute_post_connection_sql) via a new sanitize_external_text helper, so third-party JSON consumers (audit logs, API clients) never receive raw markup either; the Explain plan-info renderer is also patched to _.escape Recheck Cond and Exact Heap Blocks at construction (matching every sibling field), giving defence in depth even before DOMPurify runs.

This issue affects pgAdmin 4: from 6.0 before 9.16.

Other Security Trackers

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores
CVSS detail CNA (PostgreSQL) SUSE
Base Score 9.3 8
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Attack Vector Network Network
Attack Complexity Low High
Privileges Required None None
User Interaction Required Required
Scope Changed Changed
Confidentiality Impact High High
Integrity Impact High High
Availability Impact None None
CVSSv3 Version 3.1 3.1
CVSS v4 Scores
CVSS detail CNA (PostgreSQL) SUSE
Base Score 9.3 8.7
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Attack Vector Network Network
Attack Complexity Low High
Attack Requirements None None
Privileges Required None None
User Interaction Active Active
Vulnerable System Confidentiality Impact High High
Vulnerable System Integrity Impact High High
Vulnerable System Availability Impact None None
Subsequent System Confidentiality Impact High High
Subsequent System Integrity Impact High High
Subsequent System Availability Impact None None
CVSSv4 Version 4.0 4.0
SUSE Bugzilla entry: 1268581 [NEW]

No SUSE Security Announcements cross referenced.


Status of this issue by product and package

Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification. The updates are grouped by state of their lifecycle. SUSE product lifecycles are documented on the lifecycle page.

Product(s) Source package State
Products under general support and receiving all security fixes.
SUSE Linux Enterprise Desktop 15 SP7 pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP7 pgadmin4 Not affected
SUSE Linux Enterprise Module for Python 3 15 SP7 pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP7 pgadmin4 Not affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 pgadmin4 Not affected
Products under Long Term Service Pack support and receiving important and critical security fixes.
SUSE Linux Enterprise High Performance Computing 15 SP4 pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP5 pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS pgadmin4 Not affected
SUSE Linux Enterprise Module for Python 3 15 SP6 pgadmin4 Not affected
SUSE Linux Enterprise Module for Server Applications 15 SP4 pgadmin4 Not affected
SUSE Linux Enterprise Module for Server Applications 15 SP5 pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP4 pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP4-LTSS pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP5 pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP5-LTSS pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP6 pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP6-LTSS pgadmin4 Not affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6 pgadmin4 Not affected
SUSE Manager Proxy 4.3 pgadmin4 Not affected
SUSE Manager Proxy LTS 4.3 pgadmin4 Not affected
SUSE Manager Retail Branch Server 4.3 pgadmin4 Not affected
SUSE Manager Retail Branch Server LTS 4.3 pgadmin4 Not affected
SUSE Manager Server 4.3 pgadmin4 Not affected
SUSE Manager Server LTS 4.3 pgadmin4 Not affected
Products past their end of life and not receiving proactive updates anymore.
SUSE CaaS Platform 4.0 pgadmin4 Not affected
SUSE Enterprise Storage 6 pgadmin4 Not affected
SUSE Enterprise Storage 7 pgadmin4 Not affected
SUSE Enterprise Storage 7.1 pgadmin4 Not affected
SUSE Linux Enterprise Desktop 15 SP6 pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP1 pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP2 pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP3 pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS pgadmin4 Not affected
SUSE Linux Enterprise High Performance Computing 15 SP6 pgadmin4 Not affected
SUSE Linux Enterprise Module for Server Applications 15 SP1 pgadmin4 Not affected
SUSE Linux Enterprise Module for Server Applications 15 SP2 pgadmin4 Not affected
SUSE Linux Enterprise Module for Server Applications 15 SP3 pgadmin4 Not affected
SUSE Linux Enterprise Real Time 15 SP2 pgadmin4 Not affected
SUSE Linux Enterprise Real Time 15 SP3 pgadmin4 Not affected
SUSE Linux Enterprise Real Time 15 SP4 pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP1 pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP1-BCL pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP1-LTSS pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP2 pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP2-BCL pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP2-LTSS pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP3 pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP3-BCL pgadmin4 Not affected
SUSE Linux Enterprise Server 15 SP3-LTSS pgadmin4 Not affected
SUSE Linux Enterprise Server for SAP Applications 15 SP1 pgadmin4 Not affected
SUSE Linux Enterprise Server for SAP Applications 15 SP2 pgadmin4 Not affected
SUSE Linux Enterprise Server for SAP Applications 15 SP3 pgadmin4 Not affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4 pgadmin4 Not affected
SUSE Linux Enterprise Server for SAP Applications 15 SP5 pgadmin4 Not affected
SUSE Manager Proxy 4.0 pgadmin4 Not affected
SUSE Manager Proxy 4.1 pgadmin4 Not affected
SUSE Manager Proxy 4.2 pgadmin4 Not affected
SUSE Manager Retail Branch Server 4.0 pgadmin4 Not affected
SUSE Manager Retail Branch Server 4.1 pgadmin4 Not affected
SUSE Manager Retail Branch Server 4.2 pgadmin4 Not affected
SUSE Manager Server 4.0 pgadmin4 Not affected
SUSE Manager Server 4.1 pgadmin4 Not affected
SUSE Manager Server 4.2 pgadmin4 Not affected
openSUSE Leap 15.3 pgadmin4 Not affected
openSUSE Leap 15.4 pgadmin4 Not affected
openSUSE Leap 15.5 pgadmin4 Not affected


SUSE Timeline for this CVE

CVE page created: Fri Jun 19 04:01:23 2026
CVE page last modified: Fri Jun 19 13:28:47 2026