CVE-2026-34725
CVE-2026-34725 · dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
This page contains facts from public vulnerability sources. Check the original advisory before updating.
DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in version 7.1.5.
CVSS 8.3 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
dbgate
- Versions
- >= 7.0.0, < 7.1.5: Affected
No fix published
dbgate-web npm
- Affected ranges
- SEMVER: ≥ 7.0.0, < 7.1.5
Update to 7.1.5