DbGate SVG Icon String FontIcon.svelte cross site scripting

published 2026-04-13 6 mo ago modified 2026-06-17 4 mo ago also GHSA-j8j5-7r4h-vj2g , EUVD-2026-22087

cvss: 3.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits: 0; none known

A security vulnerability has been detected in DbGate up to 7.1.4. This affects an unknown function of the file packages/web/src/icons/FontIcon.svelte of the component SVG Icon String Handler. Such manipulation of the argument applicationIcon leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 7.1.5 mitigates this issue. It is advisable to upgrade the affected component.

Patch / fix

fixed in 2 links 1

npm dbgate-web 7.1.5
n/a DbGate 7.1.5

github.com/dbgate/dbgate/releases/tag/v7.1.5 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 6 mo ago (2026-04-14)

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CNA	3.1	3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
CNA	3.0	3.5	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C
CNA	4.0	2.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:P/A:N
GitHub	3.1	3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	dbgate-web	<7.1.5	7.1.5

Affected products

n/a DbGate

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-94 Improper Control of Generation of Code

References

github.com /dbgate/dbgate/releases/tag/v7.1.5
patch, web
vuldb.com /vuln/357135
vdb-entry, technical-description, web
vuldb.com /vuln/357135/cti
signature, permissions-required, web
vuldb.com /submit/785841
third-party-advisory, web
github.com /dbgate/dbgate/
product
nvd.nist.gov /vuln/detail/CVE-2026-6216
advisory
github.com /dbgate/dbgate
package

Sources

CVE List CVE-2026-6216
GitHub Advisory GHSA-j8j5-7r4h-vj2g
NVD CVE-2026-6216

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary