Is CVE-2026-47668 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47668 being exploited in the wild.

How severe is CVE-2026-47668?

Critical severity, with a CVSS score of 10, published 23 July 2026.

Which products and versions are affected?

DbGate <= 7.1.8; dbgate-serve (npm) <= 7.1.8, SEMVER:introduced=0,fixed=7.1.9.

Is there a fix for CVE-2026-47668?

Yes. dbgate-serve (npm): upgrade to 7.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47668 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47668?

Check whether you run DbGate or dbgate-serve (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47668: DbGate remote code execution in JSON script runner

Q: Which products and versions are affected?

DbGate <= 7.1.8; dbgate-serve (npm) <= 7.1.8, SEMVER:introduced=0,fixed=7.1.9.

Q: Is there a fix for CVE-2026-47668?

Yes. dbgate-serve (npm): upgrade to 7.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-47668 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-47668?

Check whether you run DbGate or dbgate-serve (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47668 · Severity: critical · CVSS 10 · Published 2026-07-23

DbGate, a cross-platform database management tool, contains a critical security flaw in its script execution engine. An attacker can remotely execute arbitrary commands on the server hosting the application without needing a valid username or password in default configurations. This could lead to a total compromise of the server, unauthorized access to connected databases, and theft of sensitive corporate data.

Technologies: DbGate. Vendors: DbGate, npm.

Quick answers

Is CVE-2026-47668 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47668 being exploited in the wild.
How severe is CVE-2026-47668?: Critical severity, with a CVSS score of 10, published 23 July 2026.
Which products and versions are affected?: DbGate <= 7.1.8; dbgate-serve (npm) <= 7.1.8, SEMVER:introduced=0,fixed=7.1.9.
Is there a fix for CVE-2026-47668?: Yes. dbgate-serve (npm): upgrade to 7.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47668 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47668?: Check whether you run DbGate or dbgate-serve (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

dbgate-serve (npm): upgrade to 7.1.9 or later
```
npm install dbgate-serve@7.1.9
```

Technical details

A code injection vulnerability exists in DbGate's JSON script runner at the `/runners/start` endpoint. The `functionName` and `variableName` parameters within JSON script `assign` commands are interpolated directly into dynamically generated JavaScript source code via string concatenation without proper sanitization. This generated code is subsequently executed in a forked Node.js child process. While the application attempts to nullify the `require` function as a sandbox measure, this is easily bypassed using `process.mainModule.require()`. In default deployments where 'Anonymous' authentication is enabled, this allows unauthenticated remote code execution (RCE). The issue is addressed in version 7.1.9 by adding validation for function and file names.

Affected products

DbGate DbGate <= 7.1.8

Identifiers

CVE-2026-47668
GHSA-8v3q-9vmx-36vc

Timeline

2026-03-31: disclosed: Vulnerability discovered
2026-04-22: patched: Version 7.1.9 released
2026-05-20: advisory: Public disclosure of GHSA-8v3q-9vmx-36vc
2026-07-23: other: CVE-2026-47668 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.