CVE-2026-6216 DbGate SVG Icon String FontIcon.svelte cross site scripting
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-6216?
CVE-2026-6216 is a medium-severity vulnerability in DbGate, published on 13 Apr 2026.
Official description
A security vulnerability has been detected in DbGate up to 7.1.4. This affects an unknown function of the file packages/web/src/icons/FontIcon.svelte of the component SVG Icon String Handler. Such manipulation of the argument applicationIcon leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 7.1.5 mitigates this issue. It is advisable to upgrade the affected component.
Which versions are affected by CVE-2026-6216?
2 open source packages ship an affected version, including dbgate-web.
| Package | Affected | Fixed in |
|---|---|---|
dbgate-web npm | All versions | 7.1.5 |
dbgate-web npm | All versions | 7.1.5 |
How do I fix CVE-2026-6216?
Upgrade dbgate-web to 7.1.5 or later.
Is CVE-2026-6216 being exploited?
There is no known exploitation of CVE-2026-6216 in the wild and no public exploit code.
Sources
Also known as GHSA-j8j5-7r4h-vj2g.