CVE-2026-47670

Name of the Vulnerable Software and Affected Versions DbGate versions prior to 7.1.9

Description DbGate is a cross-platform database manager. Authenticated users with valid credentials can achieve Remote Code Execution (RCE) and execute arbitrary OS commands as root. This is possible due to the unsanitized interpolation of the functionName parameter into a dynamically generated JavaScript script template within the /runners/load-reader endpoint. An attacker can inject a newline character into the functionName variable to break out of the template expression and execute arbitrary code. A previous mitigation that set require = null is bypassed using the dynamic import() language keyword, which cannot be nullified. This allows the attacker to import the child process module and execute system commands.

Recommendations Update to version 7.1.9. As a temporary workaround, restrict access to the /runners/load-reader endpoint to minimize the risk of exploitation.