CVE-2026-34725
CVE-2026-34725 · dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in version 7.1.5.
CVSS 8.3 · Alta · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
dbgate
- Versiones
- >= 7.0.0, < 7.1.5: Afectada
Sin corrección publicada
dbgate-web npm
- Intervalos de versiones afectados
- SEMVER: ≥ 7.0.0, < 7.1.5
Actualiza a 7.1.5