DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

Description

DbGate’s JSON script runner (POST /runners/start) allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.

Recommendation

Update the dbgate-serve package to the latest compatible version. Followings are version details:

• Affected version(s): <= 7.1.8
• Patched version(s): 7.1.9

References

• GHSA-8v3q-9vmx-36vc
• CVE-2026-47668
• CWE-1188
• CWE-20
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Authenticated Remote Code Execution via loadReader functionName code injection in DbGate - CVE-2026-47670
• seroval Affected by Remote Code Execution via JSON Deserialization - CVE-2026-23737
• DbGate: Remote Code Execution via functionName injection in loadReader endpoint - CVE-2026-48017
• Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified - CVE-2026-69255

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

dbgate-serve