CVE-2026-0949 Cross-site scripting in Postgres Enterprise Manager (PEM)
Stored XSS in Postgres Enterprise Manager allows privileged users to inject JavaScript executed by other users viewing charts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-0949?
CVE-2026-0949 is a medium-severity cross-site scripting vulnerability in EnterpriseDB Postgres Enterprise Manager (PEM), published on 16 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Charts menu to inject arbitrary JavaScript when creating a new chart, which is then executed by any user accessing the chart. By default only the superuser and users with pem_admin or pem_super_admin privileges are able to access the Manage Charts menu.
Weakness: CWE-79
Which versions are affected by CVE-2026-0949?
It affects 1 product.
Products include Enterprisedb Postgres Enterprise Manager.
How do I fix CVE-2026-0949?
No fix has been published for CVE-2026-0949 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-0949 being exploited?
There is no known exploitation of CVE-2026-0949 in the wild and no public exploit code.
Sources
Also known as GHSA-hv88-4696-6v9q.