Remote Code Execution Vulnerability in DbGate Database Manager
CVE-2026-47668
Key Information:
Badges
What is CVE-2026-47668?
DbGate, a cross-platform database management tool, exhibits a vulnerability allowing remote code execution through code injection in the 'functionName' parameter of JSON script 'assign' commands. This security flaw is present in versions 7.1.8 and earlier, where untrusted input is directly incorporated into dynamically generated JavaScript code using string concatenation. The maliciously crafted input can lead to execution of arbitrary code in a separate Node.js child process. Users are encouraged to upgrade to version 7.1.9, which addresses this issue.
Affected Version(s)
dbgate < 7.1.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.