Executive brief
DbGate, a cross-platform database management tool, contains a vulnerability that allows authenticated users to execute arbitrary commands on the underlying server. By exploiting a flaw in how the application handles certain internal function requests, an attacker with valid login credentials can gain full control over the system, potentially acting as a root user. This could lead to total data theft, service disruption, or further attacks on the internal network.
Technical details
An OS command injection vulnerability exists in DbGate's `/runners/load-reader` endpoint due to improper neutralization of the `functionName` parameter. The application interpolates this parameter directly into a dynamically generated JavaScript script template. An attacker can inject a newline character to break out of the template and execute arbitrary JavaScript. Although a previous mitigation attempted to disable the `require` function, attackers can bypass this using dynamic `import()` calls to load the `child_process` module. This allows for arbitrary command execution with the privileges of the application process (often root in Docker environments). The issue is resolved in version 7.1.9 by implementing validation for function and file names.
Affected products
- DbGate DbGate <= 7.1.8
Timeline
- 2026-05-20: advisory: Initial security advisory published (GHSA-wm5r-5qp3-5vxf)
- 2026-07-23: disclosed: CVE-2026-47670 published to NVD
- 2026-04-22: patched: Version 7.1.9 released with security fixes