Threats affecting pkg:github/dbgate/dbgate

A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from remote. Upgrading to version 7.2.5-beta.6 mitigates this issue. This patch is called 70e7b6b58e464d7a015ba16e8d7574b420ee4877. Upgrading the affected component is advised. This issue is distinct from CVE-2026-47668.

CVE-2026-6216 is a medium severity cross-site scripting (XSS) vulnerability in DbGate versions up to 7.1.4. It arises from improper handling of the applicationIcon argument in the SVG Icon String Handler component, specifically in the file packages/web/src/icons/FontIcon.svelte. This vulnerability can be exploited remotely and has been publicly disclosed. Upgrading to DbGate version 7.1.5 mitigates the issue.