CVE-2026-34725: Dbgate

High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days.

DbGate is cross-platform database manager. From version 7.0.0 to before version 7.1.5, a stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. This issue has been patched in version 7.1.5.

Affected products

• Dbgate Dbgate: from 7.0.0, before 7.1.5 (fixed in 7.1.5)

Published 2026-04-02. Last modified 2026-07-24.