CVE-2026-34725
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
DbGate versions 7.0.0 through 7.1.4 have a stored XSS vulnerability because attacker-controlled SVG icons are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app it can escalate to local code execution.
Risk Assessment
An attacker can steal other users' sessions or take control of a database administrator's workstation.
Recommendation
Update DbGate to version 7.1.5 or later.
Other vulnerabilities in DbGate
See all- CVE-2026-47670Critical
DbGate versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint. The require = null mitigation is trivially bypassed via dynamic import(). Version 7.1.9 contains a patch.
- CVE-2026-47669Critical
In DbGate, the unzipDirectory() function does not validate extracted file paths, allowing path traversal. In default Docker deployment, a network attacker can exploit this to execute arbitrary code as root.
- CVE-2026-47668Critical
DbGate, a cross-platform database manager, in versions 7.1.8 and prior contains a remote code execution vulnerability in the JSON script runner (POST /runners/start). Code injection occurs via the functionName parameter in JSON script assign commands, which is interpolated directly into dynamically generated JavaScript code. The code is executed in a forked Node.js child process. Version 7.1.9 contains a patch.
- CVE-2026-48017High
DbGate is a cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint interpolates the functionName parameter directly into a JavaScript code template without sanitization. An authenticated user can inject arbitrary JavaScript code that executes on the server with full Node.js process privileges, bypassing sandbox restrictions.
Original NVD description (English source)
DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in version 7.1.5.