CVE-2026-34725 - Vulnerability Analysis

Overview

DbGate 7.0.0 to < 7.1.5 contains a stored XSS caused by rendering attacker-controlled SVG icon strings as raw HTML without sanitization, letting attackers execute scripts in user browsers or escalate to local code execution in Electron app, exploit requires user interaction.

Severity & Score

Impact

Attackers can execute scripts in other users' browsers or achieve local code execution in the Electron app, potentially compromising user data or system.

Mitigation

Upgrade to version 7.1.5 or later.

References

• https://github.com/dbgate/dbgate/commit/a7d2ed11f3f3d4dfb5d2e4e5467dedafa5fa947e
• https://github.com/dbgate/dbgate/releases/tag/v7.1.5
• https://github.com/dbgate/dbgate/security/advisories/GHSA-35xm-qvjg-8m42

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner