Executive brief
DbGate, a cross-platform database management tool, contains a critical security flaw in its script execution engine. An attacker can remotely execute arbitrary commands on the server hosting the application without needing a valid username or password in default configurations. This could lead to a total compromise of the server, unauthorized access to connected databases, and theft of sensitive corporate data.
Technical details
A code injection vulnerability exists in DbGate's JSON script runner at the `/runners/start` endpoint. The `functionName` and `variableName` parameters within JSON script `assign` commands are interpolated directly into dynamically generated JavaScript source code via string concatenation without proper sanitization. This generated code is subsequently executed in a forked Node.js child process. While the application attempts to nullify the `require` function as a sandbox measure, this is easily bypassed using `process.mainModule.require()`. In default deployments where 'Anonymous' authentication is enabled, this allows unauthenticated remote code execution (RCE). The issue is addressed in version 7.1.9 by adding validation for function and file names.
Affected products
- DbGate DbGate <= 7.1.8
Timeline
- 2026-03-31: disclosed: Vulnerability discovered
- 2026-04-22: patched: Version 7.1.9 released
- 2026-05-20: advisory: Public disclosure of GHSA-8v3q-9vmx-36vc
- 2026-07-23: other: CVE-2026-47668 published to NVD