CVE-2026-34725: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34725 is a stored Cross-Site Scripting (XSS) vulnerability in DbGate, a cross-platform database manager, affecting versions 7.0.0 through 7.1.4. Attacker-controlled SVG icon strings stored in the applicationIcon field of app definitions are rendered as raw HTML without sanitization via the FontIcon.svelte component. In the web UI, this enables script execution in other users' browsers; in the Electron desktop app, it can escalate to local code execution due to insecure Electron renderer configuration. The vulnerability was published on April 2, 2026, and patched in version 7.1.5. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of input during web page generation (CWE-79) combined with improper control of code generation (CWE-94). The vulnerable component is packages/web/src/icons/FontIcon.svelte, which checks if an icon string starts with <svg and, if so, renders it directly via Svelte's {@html} directive without sanitization — making applicationIcon a stored XSS sink. An attacker with the ability to create or modify an app definition can store a malicious SVG payload (e.g., <svg onload="alert(1)">) in applicationIcon with usageRules targeting any database. The Electron desktop app is particularly vulnerable because it is configured with nodeIntegration: true and contextIsolation: false in app/src/electron.js, allowing injected JavaScript to access Node.js and Electron APIs for full local code execution. The fix, introduced in commit a7d2ed1, adds DOMPurify sanitization (DOMPurify.sanitize(iconValue, { USE_PROFILES: { svg: true, svgFilters: true } })) before rendering (GitHub Advisory, Fix Commit).

In the web UI deployment, successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other DbGate users who view a database or app entry matching the malicious app definition, enabling session hijacking, credential theft, or further attacks. In the Electron desktop application, the impact escalates to full local code execution on the victim's machine due to the unsafe renderer configuration (nodeIntegration: true, contextIsolation: false), granting the attacker access to the local file system, OS commands, and all Node.js APIs. The confidentiality, integrity, and availability of the affected system are all rated High in the CVSS scoring (GitHub Advisory).

A proof-of-concept is documented in the GitHub Security Advisory, demonstrating exploitation via a crafted app definition JSON file with a malicious applicationIcon value. However, there is no evidence of active in-the-wild exploitation or weaponization in exploit kits as of the time of disclosure. No threat actor attribution has been reported. The EPSS score is approximately 0.023% (0.000230), indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Craft malicious app definition: Create a JSON application definition file with a malicious SVG payload in the applicationIcon field and broad usageRules to match any target database:

{
  "applicationName": "XSS PoC",
  "applicationIcon": "<svg onload=\"require('child_process').exec('calc.exe')\"></svg>",
  "usageRules": [
    { "serverHostsRegex": ".*", "databaseNamesRegex": ".*" }
  ]
}

2. Deliver the payload: Social-engineer the victim into importing or saving the malicious JSON file as a DbGate application definition (e.g., by sharing it as a legitimate configuration file).
3. Trigger rendering: Wait for the victim to open a DbGate UI view (web or Electron) that renders the matching database/application icon. DbGate loads app definitions via apps/get-all-apps and passes applicationIcon to the FontIcon component.
4. XSS execution (web UI): The unsanitized SVG is injected into the DOM via {@html iconValue}, executing the embedded script in the victim's browser session — enabling session token theft or further attacks.
5. RCE escalation (Electron): In the desktop app, the injected script accesses Node.js APIs (e.g., require('child_process')) due to nodeIntegration: true and contextIsolation: false, achieving arbitrary local code execution on the victim's machine (GitHub Advisory).

• File System: Unexpected or externally sourced JSON files in DbGate's apps storage directory containing applicationIcon values that begin with <svg and include event handler attributes (e.g., onload, onerror).
• Logs: DbGate application logs showing loading of app definitions from unusual or external file paths; web server access logs with requests to apps/get-all-apps from unexpected sources.
• Process (Electron): Unusual child processes spawned by the DbGate Electron process (e.g., cmd.exe, powershell.exe, bash, curl, wget) that are not part of normal database operations.
• Network: Unexpected outbound connections from the DbGate process or Electron renderer to external IPs or domains, potentially indicating data exfiltration or C2 callback following XSS/RCE exploitation.

Upgrade DbGate to version 7.1.5 or later, which introduces DOMPurify-based sanitization of SVG icon strings before rendering via {@html}. The fix adds the dompurify dependency and applies DOMPurify.sanitize(iconValue, { USE_PROFILES: { svg: true, svgFilters: true } }) in FontIcon.svelte. No official workaround is available for users who cannot upgrade immediately; however, restricting who can create or modify app definitions and avoiding import of untrusted application definition files can reduce exposure. Desktop deployments should be prioritized for patching given the potential for local code execution (GitHub Release, Fix Commit).