pgAdmin Cross-Site Scripting Vulnerability in Query Result Rendering

A cross-site scripting (XSS) vulnerability exists in pgAdmin versions through 9.1. When a user executes a query that retrieves data containing malicious JavaScript or HTML, the application renders this content in the result grid without proper sanitization. This flaw allows embedded scripts to execute immediately in the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can execute arbitrary JavaScript in the context of the user's browser.

Reproduction

To reproduce this vulnerability, open pgAdmin and connect to a database. Navigate to the Query Tool and create a table that includes a JavaScript payload, such as an image tag with an 'onerror' event. After inserting this payload, execute a SELECT statement to retrieve the data. The JavaScript will execute in the query result grid, demonstrating the cross-site scripting vulnerability.