CVE-2026-47668 PUBLISHED

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (POST /runners/start) allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.

• https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc
• https://github.com/dbgate/dbgate/releases/tag/v7.1.9
• https://github.com/runZeroInc/nuclei-templates/blob/main/http/vulnerabilities/dbgate-unauth-rce.yaml

• CWE-20: Improper Input Validation CWE
• CWE-94: Improper Control of Generation of Code ('Code Injection') CWE
• CWE-1188: Insecure Default Initialization of Resource CWE