DbGate: Remote Code Execution via functionName injection in loadReader endpoint

Description

The POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation.

Recommendation

Update the dbgate-api package to the latest compatible version. Followings are version details:

• Affected version(s): <= 7.1.8
• Patched version(s): 7.1.9

References

• GHSA-hv83-ggc4-v385
• CVE-2026-48017
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Authenticated Remote Code Execution via loadReader functionName code injection in DbGate - CVE-2026-47670
• DbGate: Unauthenticated Remote Code Execution via JSON Script Runner - CVE-2026-47668
• Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified - CVE-2026-69255
• Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) - CVE-2026-73649

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

dbgate-api