dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration

Description

A stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization.

Recommendation

Update the dbgate-web package to the latest compatible version. Followings are version details:

• Affected version(s): >= 7.0.0, < 7.1.5
• Patched version(s): 7.1.5

References

• GHSA-35xm-qvjg-8m42
• CVE-2026-34725
• CWE-79
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Stored XSS in SEO Fields Leads to Authenticated API Data Exposure in ApostropheCMS - CVE-2026-35569
• @payloadcms/next has Stored XSS in Admin Panel - CVE-2026-34748
• md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) - CVE-2026-46492
• Stored Cross-site Scripting (XSS) in excalidraw's web embed component - CVE-2024-32472

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 1

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

dbgate-web