CVE-2026-47668
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.
View on NVDAnalysis
DbGate permite la ejecución remota de código (RCE) mediante la inyección de comandos en el parámetro functionName de sus scripts JSON. Debido a que los datos de entrada se concatenan directamente en código JavaScript ejecutado por un proceso hijo de Node.js, un atacante puede tomar control total del servidor que aloja el administrador de bases de datos. Se recomienda actualizar inmediatamente a la versión 7.1.9 para mitigar este riesgo crítico.
Relevant roles
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCWE-20CWE-94CWE-1188EPSS
No EPSS score yet (CVE may be too fresh).
Technical description
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.