# CVE-2026-47668: DbGate remote code execution in JSON script runner

Source: https://junglewise.ai/threats/cve-2026-47668-dbgate-remote-code-execution-in-json-script-runner  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-47668 · Severity: critical · CVSS 10 · Published 2026-07-23

DbGate, a cross-platform database management tool, contains a critical security flaw in its script execution engine. An attacker can remotely execute arbitrary commands on the server hosting the application without needing a valid username or password in default configurations. This could lead to a total compromise of the server, unauthorized access to connected databases, and theft of sensitive corporate data.

Technologies: [DbGate](https://junglewise.ai/threats/technologies/dbgate). Vendors: [DbGate](https://junglewise.ai/threats/vendors/dbgate), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-47668 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47668 being exploited in the wild.

**How severe is CVE-2026-47668?** Critical severity, with a CVSS score of 10, published 23 July 2026.

**Which products and versions are affected?** DbGate <= 7.1.8; dbgate-serve (npm) <= 7.1.8, SEMVER:introduced=0,fixed=7.1.9.

**Is there a fix for CVE-2026-47668?** Yes. dbgate-serve (npm): upgrade to 7.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47668 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47668?** Check whether you run DbGate or dbgate-serve (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- dbgate-serve (npm): upgrade to 7.1.9 or later

  ```sh
  npm install dbgate-serve@7.1.9
  ```


## Technical details

A code injection vulnerability exists in DbGate's JSON script runner at the `/runners/start` endpoint. The `functionName` and `variableName` parameters within JSON script `assign` commands are interpolated directly into dynamically generated JavaScript source code via string concatenation without proper sanitization. This generated code is subsequently executed in a forked Node.js child process. While the application attempts to nullify the `require` function as a sandbox measure, this is easily bypassed using `process.mainModule.require()`. In default deployments where 'Anonymous' authentication is enabled, this allows unauthenticated remote code execution (RCE). The issue is addressed in version 7.1.9 by adding validation for function and file names.

## Affected products

- DbGate DbGate <= 7.1.8

## Identifiers

- CVE-2026-47668
- GHSA-8v3q-9vmx-36vc

## Timeline

- 2026-03-31: disclosed: Vulnerability discovered
- 2026-04-22: patched: Version 7.1.9 released
- 2026-05-20: advisory: Public disclosure of GHSA-8v3q-9vmx-36vc
- 2026-07-23: other: CVE-2026-47668 published to NVD

## References

- [https://github.com/dbgate/dbgate/releases/tag/v7.1.9](https://github.com/dbgate/dbgate/releases/tag/v7.1.9)
- [https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc](https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc)
- [https://github.com/runZeroInc/nuclei-templates/blob/main/http/vulnerabilities/dbgate-unauth-rce.yaml](https://github.com/runZeroInc/nuclei-templates/blob/main/http/vulnerabilities/dbgate-unauth-rce.yaml)

## Related threats

- [DbGate missing authorization in connection management](https://junglewise.ai/threats/cve-2026-121455-dbgate-before-7-3-3-contains-a-missing-authorization)
- [DbGate path traversal in Files Endpoint](https://junglewise.ai/threats/cve-2026-101070-a-security-vulnerability-has-been-detected-in-dbgate-up-to-7-3-1)
- [DbGate arbitrary file write via path traversal in exportModelSql](https://junglewise.ai/threats/cve-2026-101069-a-weakness-has-been-identified-in-dbgate-up-to-7-3-1-affected-is)
- [DbGate path traversal in Create Connection Endpoint](https://junglewise.ai/threats/cve-2026-101068-a-security-flaw-has-been-discovered-in-dbgate-up-to-7-3-1-this)
- [DbGate path traversal in save-uploaded-file endpoint](https://junglewise.ai/threats/cve-2026-101067-a-vulnerability-was-identified-in-dbgate-up-to-6-8-1-7-0-2-7-1-8)