Vulnerability · Published Jul 23, 2026 · Assigned by GitHub_M

CVE-2026-47668DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

Critical 10.0

In plain English

A critical-severity improper input validation in dbgate from dbgate. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)3.9%top 9.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	dbgate-serve	7.1.9	GHSA-8v3q-9vmx-36vc

Affected products (as reported)

Vendor	Product	Versions
dbgate	dbgate	< 7.1.9

Weakness: CWE-20, CWE-94, CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc x_refsource_CONFIRM
https://github.com/dbgate/dbgate/releases/tag/v7.1.9 x_refsource_MISC
https://github.com/runZeroInc/nuclei-templates/blob/main/http/vulnerabilities/dbgate-unauth-rce.yaml x_refsource_MISC