dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration

Description

A stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization.

Recommendation

Update the dbgate-web package to the latest compatible version. Followings are version details:

Affected version(s): >= 7.0.0, < 7.1.5
Patched version(s): 7.1.5

References

GHSA-35xm-qvjg-8m42
CVE-2026-34725
CWE-79
CWE-94
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration and gives you actionable findings to investigate.

Start a free scan

Related Issues

TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
Fabric.js Affected by Stored XSS via SVG Export - CVE-2026-27013
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - @haxtheweb/video-player - CVE-2026-46396
Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover - CVE-2026-46396

CSRF, XXE, and 12 Other Security Acronyms Explained

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

See something that needs correcting? Let us knowUpdated April 06, 2026