https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T15:07:58.585348+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-280085 EUVD-2026-280085 2026-10-06T15:07:58.635048+00:00 EUVD-2026-280085 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34725 fkie_cve-2026-34725 2026-10-06T15:07:58.635083+00:00

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in version 7.1.5.

 https://cve.radiocsirt.org/vuln/ghsa-35xm-qvjg-8m42 GHSA-35xm-qvjg-8m42 — dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration 2026-10-06T15:07:58.635116+00:00

Affected: npm: dbgate-web

### Summary A stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`.

### Details The issue is in the icon rendering path:

- `packages/web/src/icons/FontIcon.svelte` - treats any icon string starting with `<svg` as inline SVG - renders it with `{@html iconValue}` without sanitization - `packages/api/src/controllers/apps.js` - loads app definitions from disk and returns `applicationIcon` to clients unchanged - `packages/web/src/appobj/DatabaseAppObject.svelte` - passes `applicationIcon` into `additionalIcons` - `packages/web/src/appobj/AppObjectCore.svelte` - renders those icons through `<FontIcon icon={ic.icon}>`

This makes `applicationIcon` a stored XSS sink.

An attacker who can create or modify an app definition can store a payload in `applicationIcon`. When another user views a matching database/app entry, the payload executes in that user's session.

The impact is especially severe in Electron desktop because:

- `app/src/electron.js` - `nodeIntegration: true` - `contextIsolation: false`

With that configuration, JavaScript gained through XSS can access Node/Electron APIs, making local code execution possible.

### PoC This was reproduced by creatin…