JavaScript Code Injection in DbGate Database Management Software
CVE-2026-48017
Key Information:
Badges
What is CVE-2026-48017?
DbGate, a cross-platform database manager, has a vulnerability in its /runners/load-reader endpoint. In versions 7.1.8 and earlier, an authenticated user can exploit the functionName parameter, which is directly interpolated into a JavaScript code template without appropriate sanitization. This oversight permits the execution of arbitrary JavaScript code on the server, allowing users with basic access, but without special permissions, to run arbitrary OS commands within the privileges of the Node.js process. They can also read and write any files accessible to the process, obtain connection credentials from DbGate's storage, and potentially gain unauthorized access to connected databases. In Docker deployments, this could result in root access within the container, exposing the host system to significant risk.
Affected Version(s)
dbgate < 7.1.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.