CVE-2026-47668
CriticalCVSS 10.0Exploitation Probability (EPSS)
Very high risk90th percentile - higher than 90% of all known CVEs
Summary
DbGate, a cross-platform database manager, in versions 7.1.8 and prior contains a remote code execution vulnerability in the JSON script runner (POST /runners/start). Code injection occurs via the functionName parameter in JSON script assign commands, which is interpolated directly into dynamically generated JavaScript code. The code is executed in a forked Node.js child process. Version 7.1.9 contains a patch.
Risk Assessment
An attacker can remotely execute arbitrary code on the DbGate server, leading to full compromise of managed databases.
Recommendation
Update DbGate to version 7.1.9 or later.
Original NVD description (English source)
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.