PT-2026-43683 · Unknown · Dbgate-Serve
CVE-2026-47668
·
Published
2026-05-27
·
Updated
2026-07-24
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
DbGate versions prior to 7.1.9
Description
DbGate contains a flaw that allows remote code execution via code injection. The issue exists in the JSON script runner, specifically within the
assign commands. An attacker can inject malicious code through the functionName and variableName parameters in the POST /runners/start endpoint, or the functionName parameter in the POST /runners/load-reader endpoint. The application interpolates these values directly into dynamically generated JavaScript source code using string concatenation, which is then executed in a forked Node.js child process. In default deployments where authentication is disabled, this can lead to unauthenticated full system compromise.Recommendations
Update DbGate to version 7.1.9.
As a temporary workaround, restrict access to the
POST /runners/start and POST /runners/load-reader endpoints.
Avoid using the functionName and variableName parameters in JSON script commands until the update is applied.Exploit
Fix
RCE
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Dbgate-Serve