CVE-2026-47668
Deferred Deferred - Pending Action

DbGate Remote Code Execution via JSON Script Runner

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: GitHub, Inc.

Description
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-47668
EUVD
EUVD-2026-48340

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
dbgate dbgate to 7.1.9 (exc)
dbgate dbgate 7.1.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47668 is an unauthenticated remote code execution (RCE) vulnerability in DbGate versions 7.1.8 and earlier. It exists in the JSON script runner functionality, specifically in the POST /runners/start endpoint. User-controlled input in the functionName parameter of JSON script assign commands is directly interpolated into dynamically generated JavaScript code without proper validation. This allows attackers to inject malicious JavaScript code that executes in a forked Node.js child process, granting full access to system resources.

Detection Guidance

Use the Nuclei template from Resource 2 to detect vulnerable instances. The template sends a POST request to /runners/start with a malicious payload and checks for an out-of-band DNS interaction via nslookup. Example command: nuclei -u http://target -t nuclei-templates/http/vulnerabilities/dbgate-unauth-rce.yaml

Alternatively, manually test by sending a POST request to /runners/start with a functionName parameter containing malicious JavaScript code and observe if arbitrary commands execute.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the server without authentication. They can gain full access to system resources, including child_process, fs, and net modules. This could lead to complete system compromise, data theft, unauthorized modifications, or disruption of services. The impact is severe with a CVSS score of 10.0 for default deployments where authentication is disabled.

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR requires protection of personal data, and a breach could lead to violations. HIPAA mandates safeguards for protected health information; a successful attack could result in unauthorized exposure or modification of such data. Both regulations require timely breach notification, which would be triggered by this vulnerability.

Mitigation Strategies

Upgrade DbGate to version 7.1.9 or later immediately, as it contains the patch for this vulnerability.

If upgrading is not immediately possible, disable the JSON script runner functionality or restrict access to the /runners/start endpoint to trusted users only.

Ensure authentication is enabled and not set to anonymous mode to reduce the attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47668. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart