CVE-2025-2946: pgAdmin 4 Cross-Site Scripting (XSS) Vulnerability in Query Result Rendering
Summary
CVE-2025-2946: pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering. Affects pgadmin4 versions < 9.2. Fixed in 9.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pgAdmin 4 is a popular open-source administration and development platform for PostgreSQL. It provides a web-based interface for database management, allowing users to execute SQL queries, manage database objects, and visualize data. However, versions of pgAdmin up to 9.1 are vulnerable to a Cross-Site Scripting (XSS) attack, which can compromise user security and data integrity.
Vulnerability Detail
The vulnerability arises from improper handling of user-generated content in query result rendering. Attackers can exploit this flaw by injecting arbitrary HTML or JavaScript code into the query results. When a user views these results, the malicious code executes in their browser, potentially leading to unauthorized actions, data theft, or session hijacking. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), and it has a CVSS score of 9.1, indicating a critical severity level.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.2
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==9.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid executing untrusted queries or disable the rendering of query results that may contain user-generated content until the software is updated. However, this is not a permanent solution and upgrading is strongly recommended.
Conclusion
The pgAdmin 4 vulnerability (CVE-2025-2946) poses a significant risk due to its potential for Cross-Site Scripting attacks. Users are strongly advised to upgrade to version 9.2 or later to mitigate this risk. Regular monitoring of dependencies using tools like Vulert can help maintain security in open-source applications.
See every vulnerability recorded for pgadmin4 →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and security.
If you are using pgAdmin version 9.1 or earlier, your installation is vulnerable to this XSS attack. Check your version in the application settings.
Exploiting this vulnerability can lead to unauthorized access to user sessions, data theft, and other malicious actions performed in the context of the affected user's browser.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using the Pipfile.lock. You can check your application for vulnerabilities without any signup at the Vulert playground.
If an immediate upgrade is not possible, implement the suggested workaround by avoiding untrusted queries and disabling rendering of potentially harmful content until you can update.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
