Description
The POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation.
Recommendation
Update the dbgate-api package to the latest compatible version. Followings are version details:
- Affected version(s): <= 7.1.8
- Patched version(s): 7.1.9
References
Could your website be exposed too?
SmartScanner can check your website for DbGate: Remote Code Execution via functionName injection in loadReader endpoint and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Authenticated Remote Code Execution via loadReader functionName code injection in DbGate - CVE-2026-47670
- DbGate: Unauthenticated Remote Code Execution via JSON Script Runner - CVE-2026-47668
- Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified - CVE-2026-69255
- Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) - CVE-2026-73649
You might also like:
See something that needs correcting? Let us knowUpdated July 08, 2026