Vulnerability · Published Jul 23, 2026 · Assigned by GitHub_M

CVE-2026-47670DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

Critical 9.4

In plain English

A critical-severity command injection in dbgate from dbgate. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)1.8%top 22.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. Version 7.1.9 contains a patch.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	dbgate-api	7.1.9	GHSA-wm5r-5qp3-5vxf

Affected products (as reported)

Vendor	Product	Versions
dbgate	dbgate	< 7.1.9

Weakness: CWE-77, CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/dbgate/dbgate/security/advisories/GHSA-wm5r-5qp3-5vxf x_refsource_CONFIRM
https://github.com/dbgate/dbgate/releases/tag/v7.1.9 x_refsource_MISC