Executive brief
DbGate is a database management tool used to connect to and manage various database systems. A security flaw allows any logged-in user, even those without administrative rights, to execute malicious code on the server hosting the application. This could lead to a total system takeover, unauthorized access to all connected databases, and the theft or deletion of sensitive data.
Technical details
A code injection vulnerability exists in the 'loadReader' endpoint of DbGate due to the lack of sanitization of the 'functionName' parameter. This parameter is directly interpolated into a JavaScript template used by the 'loaderScriptTemplate' function. While the application attempts to sandbox the execution by setting 'require=null', an attacker can bypass this restriction using 'process.binding("spawn_sync")' to execute arbitrary OS commands with the privileges of the Node.js process. Unlike other sensitive endpoints in DbGate, this specific endpoint lacks necessary permission checks (such as 'run-shell-script'), allowing any authenticated user to achieve remote code execution (RCE). The issue is addressed in version 7.1.9.
Affected products
- DbGate DbGate <= 7.1.8
- npm dbgate-api <= 7.1.8
Timeline
- 2026-04-22: patched: Version 7.1.9 released with security fixes
- 2026-05-22: advisory: GitHub Security Advisory GHSA-hv83-ggc4-v385 published
- 2026-06-15: disclosed: CVE-2026-48017 published to NVD