Skip to content
CVSS 10.0CVSS 10.0 · CRITICAL

CVE-2026-47668

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.

View on NVD

Analysis

DbGate permite la ejecución remota de código (RCE) mediante la inyección de comandos en el parámetro functionName de sus scripts JSON. Debido a que los datos de entrada se concatenan directamente en código JavaScript ejecutado por un proceso hijo de Node.js, un atacante puede tomar control total del servidor que aloja el administrador de bases de datos. Se recomienda actualizar inmediatamente a la versión 7.1.9 para mitigar este riesgo crítico.

Relevant roles

JavascriptTypescriptSqlNosqlBackendCyberSecurity

Severity

Score: 10.0(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: CHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-20CWE-94CWE-1188

EPSS

No EPSS score yet (CVE may be too fresh).

Technical description

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.

Published: 7/23/2026, 6:16:53 PM
Last modified: 7/23/2026, 7:16:54 PM

References

HomeEventsBlogResourcesTeam