TI-2026-26969 Aliases CVE-2026-34725 GHSA-35xm-qvjg-8m42

dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration

HIGH 71CWE-79Published 2026-04-02 · Updated 2026-04-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting, Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-94.

Summary

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in version 7.1.5.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00175 6th percentileScored 2026-11-07

Fix Fixed dbgate (dbgate): 7.1.5dbgate-web (npm): 7.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
dbgate	dbgate	7.0.0 to before 7.1.5	7.1.5	Patch available	CNA
—	dbgate-web (npm)	7.0.0 to before 7.1.5	7.1.5	Patch available	GHSA-35xm-qvjg-8m42

dbgate Vendordbgate Affected 7.0.0 to before 7.1.5 Fixed in 7.1.5 Patch available CNA
dbgate-web (npm) Vendor— Affected 7.0.0 to before 7.1.5 Fixed in 7.1.5 Patch available GHSA-35xm-qvjg-8m42

Remediation

Fix · CNA dbgate (dbgate) Fixed in 7.1.5
Fix · GHSA-35xm-qvjg-8m42 dbgate-web (npm) Fixed in 7.1.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-34725
2026-10-03 Alias added: GHSA-35xm-qvjg-8m42

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-34725

Other 4

TI-2026-35175 DbGate: Unauthenticated Remote Code Execution via JSON Script Runner CVSS 3.1CRITICAL 10.0
TI-2026-35176 DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE CVSS 4.0CRITICAL 9.3
TI-2026-35177 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection CVSS 4.0CRITICAL 9.4
TI-2026-35462 DbGate: Remote Code Execution via functionName injection in loadReader endpoint CVSS 3.1HIGH 8.8
TI-2025-32068 DbGate allows Unauthorized File Access via CSV Plugin CVSS 4.0HIGH 7.0
TI-2026-58509 DbGate through 7.2.6 Arbitrary File Read and Write via file:// jslid CVSS 4.0HIGH 8.7

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences