Remote Code Execution Vulnerability in DbGate Database Manager

CVE-2026-47668

What is CVE-2026-47668?

DbGate, a cross-platform database management tool, exhibits a vulnerability allowing remote code execution through code injection in the 'functionName' parameter of JSON script 'assign' commands. This security flaw is present in versions 7.1.8 and earlier, where untrusted input is directly incorporated into dynamically generated JavaScript code using string concatenation. The maliciously crafted input can lead to execution of arbitrary code in a separate Node.js child process. Users are encouraged to upgrade to version 7.1.9, which addresses this issue.

References