dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration

published 2026-04-01 7 mo ago modified 2026-07-24 3 mo ago also GHSA-35xm-qvjg-8m42 , EUVD-2026-18472

cvss: 8.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits: 0; none known

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in version 7.1.5.

Patch / fix

fixed in 1 links 2

npm dbgate-web 7.1.5

github.com/dbgate/dbgate@a7d2ed1 commit
github.com/dbgate/dbgate/releases/tag/v7.1.5 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 7 mo ago (2026-04-02)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
GitHub	3.1	8.2	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	dbgate-web	>=7.0.0, <7.1.5	7.1.5

Affected products

dbgate dbgate

Classification

Weakness

CWE-94 Improper Control of Generation of Code
CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary