CVE-2026-34725: DbGate stored XSS and RCE via unsanitized SVG icons

CVE-2026-34725 · Severity: high · CVSS 8.2 · Published 2026-04-02

DbGate is a database manager application available as a web app and Electron desktop client. A stored cross-site scripting (XSS) vulnerability in the applicationIcon field allows attackers to inject malicious code that executes when users view application definitions. In the desktop version, this can escalate to remote code execution because Electron is configured unsafely, potentially giving attackers full control of the victim's machine.

Technologies: DbGate. Vendors: DbGate, npm.

Quick answers

Is CVE-2026-34725 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34725 being exploited in the wild.
How severe is CVE-2026-34725?
High severity, with a CVSS score of 8.2, published 2 April 2026.
Which products and versions are affected?
DbGate >= 7.0.0, < 7.1.5, 7.0.0 to 7.1.4; dbgate-web (npm) SEMVER:introduced=7.0.0,fixed=7.1.5.
Is there a fix for CVE-2026-34725?
Yes. dbgate-web (npm): upgrade to 7.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34725 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-34725?
Check whether you run DbGate or dbgate-web (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • dbgate-web (npm): upgrade to 7.1.5 or later
    npm install dbgate-web@7.1.5

Technical details

The vulnerability is a stored XSS (CWE-79) in the applicationIcon rendering path. The FontIcon component in packages/web/src/icons/FontIcon.svelte renders SVG strings via {@html} without sanitization, and the applications API (packages/api/src/controllers/apps.js) returns applicationIcon values unchanged from disk. An attacker who can create or modify an app definition JSON file can inject JavaScript payloads within SVG markup. When another user opens a UI view displaying the malicious icon, the payload executes in that user's session. The attack requires local file write access to place the malicious app definition, but user interaction (viewing the icon) is required. The impact is especially severe in the Electron desktop app because it is configured with nodeIntegration: true and contextIsolation: false, allowing the injected JavaScript to access Node APIs and achieve local code execution. The vulnerability affects dbgate-web versions 7.0.0 through 7.1.4 and is fixed in 7.1.5.

Affected products

  • dbgate dbgate-web 7.0.0 to 7.1.4

Identifiers

  • CVE-2026-34725
  • GHSA-35xm-qvjg-8m42

Timeline

  • 2026-04-01: disclosed
  • 2026-04-01: patched: Fixed in version 7.1.5
  • 2026-04-02: advisory: NVD published entry CVE-2026-34725

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.