{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-12048",
        "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "state": "PUBLISHED",
        "assignerShortName": "PostgreSQL",
        "dateReserved": "2026-06-11T20:40:08.398Z",
        "datePublished": "2026-06-18T23:37:41.541Z",
        "dateUpdated": "2026-06-22T19:15:36.006Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
                "shortName": "PostgreSQL",
                "dateUpdated": "2026-06-18T23:37:41.541Z"
            },
            "title": "pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser",
            "affected": [
                {
                    "vendor": "pgadmin.org",
                    "product": "pgAdmin 4",
                    "repo": "https://github.com/pgadmin-org/pgadmin4",
                    "modules": [
                        "Notifier",
                        "Form Components",
                        "Modal Provider",
                        "Explain Visualiser",
                        "Driver"
                    ],
                    "programFiles": [
                        "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/static/js/components/FormComponents.jsx",
                        "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/static/js/Notifier.jsx",
                        "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/driver/psycopg3/connection.py",
                        "https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/tools/erd/static/js/erd_tool/components/Explain/Analysis.jsx"
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "6.0",
                            "lessThan": "9.16",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields) was passed verbatim through html-react-parser at every user-facing sink — the notifier toasts, FormFooterMessage / FormInput help and error areas, FormNote, ModalProvider AlertContent and confirmDelete, ToolErrorView, the Explain visualiser's NodeText panel, the SQL editor confirm dialogs, ConfirmSaveContent, PreferencesHelper modal alerts, and SelectThemes helper text. A PostgreSQL server an attacker controls — or any server returning attacker-influenced text such as a table or column name a low-privilege database user can create — could inject arbitrary HTML (including <iframe>) into the pgAdmin DOM the moment the victim's pgAdmin connected to that server or viewed an Explain plan that referenced the crafted object.\n\nThe injected iframe's srcdoc could fetch attacker-served JavaScript and, by writing to parent.location, redirect the victim's top-level pgAdmin browser tab to an attacker-controlled URL. Because the injection originates from inside pgAdmin's own interface, standard anti-clickjacking controls (X-Frame-Options, Content-Security-Policy: frame-ancestors) do not mitigate it. A phishing page rendered inside the legitimate pgAdmin window is indistinguishable from a genuine pgAdmin dialog.\n\nFix combines three complementary layers. (1) DOMPurify sanitisation is wrapped around every html-react-parser call site reachable from notifier, alert, form-error, Explain, and SQL-editor flows. (2) A new plain-text rendering contract — SafeMessage / SafeHtmlMessage components plus Notifier.errorText / alertText / warningText / infoText / successText helpers — is introduced; around fifty callers across browser, tools, dashboard, debugger, misc, llm, preferences, schema diff, and the SQL editor that previously interpolated backend-derived strings are migrated to the plain-text variants. (3) Backend HTML-escape is applied at the post-connection-SQL handler (execute_post_connection_sql) via a new sanitize_external_text helper, so third-party JSON consumers (audit logs, API clients) never receive raw markup either; the Explain plan-info renderer is also patched to _.escape Recheck Cond and Exact Heap Blocks at construction (matching every sibling field), giving defence in depth even before DOMPurify runs.\n\nThis issue affects pgAdmin 4: from 6.0 before 9.16."
                }
            ],
            "references": [
                {
                    "url": "https://github.com/pgadmin-org/pgadmin4/issues/10068",
                    "tags": [
                        "issue-tracking"
                    ]
                },
                {
                    "url": "https://github.com/pgadmin-org/pgadmin4/commit/9e370d3cb67b83b3945f82969c959fad3f926517",
                    "tags": [
                        "patch"
                    ]
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "An attacker who controls (or has write access to) content a PostgreSQL server returns -- ErrorResponse text, quoted object names inside relation-does-not-exist errors, EXPLAIN Recheck Cond / Exact Heap Blocks fields -- crafts HTML containing an iframe whose srcdoc executes attacker JS. When a pgAdmin user connects to that server (or views an Explain plan referencing the crafted object), the attacker HTML is rendered in the pgAdmin UI.\n\nWhy C:H/I:H (not L/L): pgAdmin's default Content-Security-Policy carries 'unsafe-inline' and 'unsafe-eval' so it does not constrain script execution; an iframe rendered via the srcdoc attribute inherits the embedding origin, so the attacker JS runs same-origin to the victim's authenticated pgAdmin session. From there the attacker can read every saved server connection credential (high confidentiality) and issue arbitrary SQL against every server the victim is connected to (high integrity), via pgAdmin's own API with the user's CSRF token. This is the confused-deputy pattern -- third-party content drives the victim admin -- so S:C is straightforward. A:N because the primary impact is data exfil / takeover, not denial of service."
                        }
                    ],
                    "cvssV3_1": {
                        "version": "3.1",
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "privilegesRequired": "NONE",
                        "userInteraction": "REQUIRED",
                        "scope": "CHANGED",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "HIGH",
                        "availabilityImpact": "NONE",
                        "baseSeverity": "CRITICAL",
                        "baseScore": 9.3,
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N"
                    }
                },
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "Same reasoning as the CVSS 3.1 entry. The same-origin JS executing in the victim's pgAdmin session reads the vulnerable system's saved connection store (VC:H) and issues SQL on every downstream PostgreSQL server the victim has registered (VI:H, plus SC:H/SI:H for the subsequent systems). A:N because the goal is takeover / exfil rather than denial of service."
                        }
                    ],
                    "cvssV4_0": {
                        "version": "4.0",
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
                        "baseScore": 9.3,
                        "baseSeverity": "CRITICAL"
                    }
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
                            "cweId": "CWE-79",
                            "type": "CWE"
                        },
                        {
                            "lang": "en",
                            "description": "CWE-116 Improper Encoding or Escaping of Output",
                            "cweId": "CWE-116",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "Fernando Bortotti <fernando.bortotti@bsd.com.br>",
                    "type": "finder"
                },
                {
                    "lang": "en",
                    "value": "Dave Page <dpage@pgadmin.org>",
                    "type": "remediation developer"
                },
                {
                    "lang": "en",
                    "value": "Ashesh Vashi <ashesh.vashi@enterprisedb.com>",
                    "type": "remediation developer"
                },
                {
                    "lang": "en",
                    "value": "Ashesh Vashi <ashesh.vashi@enterprisedb.com>",
                    "type": "remediation reviewer"
                }
            ],
            "source": {
                "discovery": "EXTERNAL"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2026-06-22T19:15:27.799712Z",
                                "id": "CVE-2026-12048",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "total"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-06-22T19:15:36.006Z"
                }
            }
        ]
    }
}