CVE-2026-34725: dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration

April 1, 2026 (updated April 6, 2026)

A stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user’s browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false.

References

github.com/advisories/GHSA-35xm-qvjg-8m42
github.com/dbgate/dbgate
github.com/dbgate/dbgate/commit/a7d2ed11f3f3d4dfb5d2e4e5467dedafa5fa947e
github.com/dbgate/dbgate/releases/tag/v7.1.5
github.com/dbgate/dbgate/security/advisories/GHSA-35xm-qvjg-8m42
nvd.nist.gov/vuln/detail/CVE-2026-34725

Code Behaviors & Features

Detect and mitigate CVE-2026-34725 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →