CVE-2026-48017: DbGate code injection in load-reader endpoint

CVE-2026-48017 · Severity: high · CVSS 8.8 · Published 2026-06-15

DbGate is a database management tool used to connect to and manage various database systems. A security flaw allows any logged-in user, even those without administrative rights, to execute malicious code on the server hosting the application. This could lead to a total system takeover, unauthorized access to all connected databases, and the theft or deletion of sensitive data.

Technologies: DbGate. Vendors: DbGate, npm.

Quick answers

Is CVE-2026-48017 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48017 being exploited in the wild.
How severe is CVE-2026-48017?
High severity, with a CVSS score of 8.8, published 15 June 2026.
Which products and versions are affected?
DbGate <= 7.1.8; dbgate-api (npm) <= 7.1.8, SEMVER:introduced=0,fixed=7.1.9.
Is there a fix for CVE-2026-48017?
Yes. dbgate-api (npm): upgrade to 7.1.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48017 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48017?
Check whether you run DbGate or dbgate-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • dbgate-api (npm): upgrade to 7.1.9 or later
    npm install dbgate-api@7.1.9

Technical details

A code injection vulnerability exists in the 'loadReader' endpoint of DbGate due to the lack of sanitization of the 'functionName' parameter. This parameter is directly interpolated into a JavaScript template used by the 'loaderScriptTemplate' function. While the application attempts to sandbox the execution by setting 'require=null', an attacker can bypass this restriction using 'process.binding("spawn_sync")' to execute arbitrary OS commands with the privileges of the Node.js process. Unlike other sensitive endpoints in DbGate, this specific endpoint lacks necessary permission checks (such as 'run-shell-script'), allowing any authenticated user to achieve remote code execution (RCE). The issue is addressed in version 7.1.9.

Affected products

  • DbGate DbGate <= 7.1.8
  • npm dbgate-api <= 7.1.8

Identifiers

  • CVE-2026-48017
  • GHSA-hv83-ggc4-v385

Timeline

  • 2026-04-22: patched: Version 7.1.9 released with security fixes
  • 2026-05-22: advisory: GitHub Security Advisory GHSA-hv83-ggc4-v385 published
  • 2026-06-15: disclosed: CVE-2026-48017 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.