CVE-2025-2946 pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering

Q: Which versions are affected by CVE-2025-2946?

3 open source packages ship an affected version, including pgadmin4. It affects 1 product.

Q: Is CVE-2025-2946 being exploited?

There is no known exploitation of CVE-2025-2946 in the wild and no public exploit code.

Q: How do I fix CVE-2025-2946?

Upgrade pgadmin4 to 9.2 or later.

Critical 9.1 Published 3 Apr 2025 Updated 3 Apr 2025

Attackers can execute arbitrary HTML or JavaScript in a user's browser via query result rendering in pgAdmin 4.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-2946?

CVE-2025-2946 is a critical cross-site scripting vulnerability in pgadmin.org pgAdmin 4, published on 3 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser through query result rendering, then HTML/JavaScript runs on the browser.

Weakness: CWE-79

Which versions are affected by CVE-2025-2946?

3 open source packages ship an affected version, including pgadmin4. It affects 1 product.

Package	Affected	Fixed in
`pgadmin4` PyPI	All versions	`9.2`
`pgadmin4` PyPI	All versions	`9.2`
`pgadmin4` PyPI	All versions	`9.2`

Products include Pgadmin Pgadmin 4.

How do I fix CVE-2025-2946?

Upgrade pgadmin4 to 9.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-2946 being exploited?

There is no known exploitation of CVE-2025-2946 in the wild and no public exploit code.

Sources

Also known as GHSA-2rrx-pphc-qfv9, PYSEC-2026-449.