Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A security vulnerability has been detected in DbGate up to 7.1.4. This affects an unknown function of the file packages/web/src/icons/FontIcon.svelte of the component SVG Icon String Handler. Such manipulation of the argument applicationIcon leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 7.1.5 mitigates this issue. It is advisable to upgrade the affected component.
Recommended action: Upgrade to 7.1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored XSS vulnerability exists in DbGate because attacker-controlled SVG icon strings are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app this can escalate to local code execution because Electron is configured with nodeIntegration: true and contextIsolation: false. Details The issue is in the icon rendering path: - packages/web/src/icons/FontIcon.svelte - treats any icon string starting with <svg as inline SVG - renders it with {@html iconValue} without sanitization - packages/api/src/controllers/apps.js - loads app definitions from disk and returns applicationIcon to clients unchanged - packages/web/src/appobj/DatabaseAppObject.svelte - passes applicationIcon into additionalIcons - packages/web/src/appobj/AppObjectCore.svelte - renders those icons through <FontIcon icon={ic.icon} This makes applicationIcon a stored XSS sink. An attacker who can create or modify an app definition…
Recommended action: Upgrade to 7.1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.