Executive brief
DbGate is a database manager application available as a web app and Electron desktop client. A stored cross-site scripting (XSS) vulnerability in the applicationIcon field allows attackers to inject malicious code that executes when users view application definitions. In the desktop version, this can escalate to remote code execution because Electron is configured unsafely, potentially giving attackers full control of the victim's machine.
Technical details
The vulnerability is a stored XSS (CWE-79) in the applicationIcon rendering path. The FontIcon component in packages/web/src/icons/FontIcon.svelte renders SVG strings via {@html} without sanitization, and the applications API (packages/api/src/controllers/apps.js) returns applicationIcon values unchanged from disk. An attacker who can create or modify an app definition JSON file can inject JavaScript payloads within SVG markup. When another user opens a UI view displaying the malicious icon, the payload executes in that user's session. The attack requires local file write access to place the malicious app definition, but user interaction (viewing the icon) is required. The impact is especially severe in the Electron desktop app because it is configured with nodeIntegration: true and contextIsolation: false, allowing the injected JavaScript to access Node APIs and achieve local code execution. The vulnerability affects dbgate-web versions 7.0.0 through 7.1.4 and is fixed in 7.1.5.
Affected products
- dbgate dbgate-web 7.0.0 to 7.1.4
Timeline
- 2026-04-01: disclosed
- 2026-04-01: patched: Fixed in version 7.1.5
- 2026-04-02: advisory: NVD published entry CVE-2026-34725