https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:01:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-280085 EUVD-2026-280085 https://cve.radiocsirt.org/vuln/euvd-2026-280085 https://cve.radiocsirt.org/vuln/fkie_cve-2026-34725 <p>DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user&#39;s browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in version 7.1.5.</p> <p>DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user&#39;s browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in version 7.1.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-34725 https://cve.radiocsirt.org/vuln/ghsa-35xm-qvjg-8m42 <p><strong>Affected:</strong> npm: dbgate-web</p> <p>### Summary A stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user&#39;s browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`.</p> <p>### Details The issue is in the icon rendering path:</p> <p>- `packages/web/src/icons/FontIcon.svelte` - treats any icon string starting with `&lt;svg` as inline SVG - renders it with `{@html iconValue}` without sanitization - `packages/api/src/controllers/apps.js` - loads app definitions from disk and returns `applicationIcon` to clients unchanged - `packages/web/src/appobj/DatabaseAppObject.svelte` - passes `applicationIcon` into `additionalIcons` - `packages/web/src/appobj/AppObjectCore.svelte` - renders those icons through `&lt;FontIcon icon={ic.icon}&gt;`</p> <p>This makes `applicationIcon` a stored XSS sink.</p> <p>An attacker who can create or modify an app definition can store a payload in `applicationIcon`. When another user views a matching database/app entry, the payload executes in that user&#39;s session.</p> <p>The impact is especially severe in Electron desktop because:</p> <p>- `app/src/electron.js` - `nodeIntegration: true` - `contextIsolation: false`</p> <p>With that configuration, JavaScript gained through XSS can access Node/Electron APIs, making local code execution possible.</p> <p>### PoC This was reproduced by creatin…</p> <p><strong>Affected:</strong> npm: dbgate-web</p> <p>### Summary A stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user&#39;s browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with `nodeIntegration: true` and `contextIsolation: false`.</p> <p>### Details The issue is in the icon rendering path:</p> <p>- `packages/web/src/icons/FontIcon.svelte` - treats any icon string starting with `&lt;svg` as inline SVG - renders it with `{@html iconValue}` without sanitization - `packages/api/src/controllers/apps.js` - loads app definitions from disk and returns `applicationIcon` to clients unchanged - `packages/web/src/appobj/DatabaseAppObject.svelte` - passes `applicationIcon` into `additionalIcons` - `packages/web/src/appobj/AppObjectCore.svelte` - renders those icons through `&lt;FontIcon icon={ic.icon}&gt;`</p> <p>This makes `applicationIcon` a stored XSS sink.</p> <p>An attacker who can create or modify an app definition can store a payload in `applicationIcon`. When another user views a matching database/app entry, the payload executes in that user&#39;s session.</p> <p>The impact is especially severe in Electron desktop because:</p> <p>- `app/src/electron.js` - `nodeIntegration: true` - `contextIsolation: false`</p> <p>With that configuration, JavaScript gained through XSS can access Node/Electron APIs, making local code execution possible.</p> <p>### PoC This was reproduced by creatin…</p> https://cve.radiocsirt.org/vuln/ghsa-35xm-qvjg-8m42