GHSA-35xm-qvjg-8m42
High · 8.2CVSS
8.2
EPSS
—
Published
Apr 1, 2026
CISA due date
—
The record
dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | dbgate-web | 7.0.0 | 7.1.5 |
Related vulnerabilities
- CVE-2026-34725 DbGate is cross-platform database manager. Same vulnerability
- GHSA-j8j5-7r4h-vj2g DbGate has cross site scripting via the SVG Icon String Handler component Also affects dbgate-web
- CVE-2026-6216 A security vulnerability has been detected in DbGate up to 7.1.4. Also affects dbgate-web
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79