PT-2026-47063 · Dbgate+1 · Dbgate+1

CVE-2026-47670 · Published 2026-06-05 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions DbGate versions prior to 7.1.9

Description DbGate is subject to authenticated remote code execution. Users with valid credentials can execute arbitrary operating system commands as root by exploiting an unsanitized functionName parameter in the '/runners/load-reader' endpoint. The application interpolates this parameter directly into a dynamically generated JavaScript script template. By injecting a newline character, an attacker can break out of the template and execute arbitrary JavaScript. This process can bypass existing mitigations that nullify the require function by using the dynamic import() language keyword to load the child process module.

Recommendations As a temporary workaround, restrict access to the '/runners/load-reader' endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-47670

GHSA-WM5R-5QP3-5VXF

Affected Products

Dbgate

Dbgate-Api

References · 8

• https://osv.dev/vulnerability/GHSA-wm5r-5qp3-5vxf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47670 · Security Note
• https://github.com/dbgate/dbgate/security/advisories/GHSA-wm5r-5qp3-5vxf · Note
• https://github.com/dbgate/dbgate/releases/tag/v7.1.9 · Note
• https://github.com/dbgate/dbgate · Note
• https://twitter.com/pdnuclei_bot/status/2066430545979134085 · Twitter Post
• https://twitter.com/UpwindMDR/status/2062947268307587535 · Twitter Post
• https://twitter.com/denizhalilT/status/2066626914303832451 · Twitter Post