Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with full process privileges, bypassing the require=null sandbox restriction. Details The loadReader endpoint in packages/api/src/controllers/runners.js (line 353) takes a functionName parameter from the request body and passes it to compileShellApiFunctionName() which performs no sanitization: Vulnerable code (permalink): The loaderScriptTemplate at line 57-68 directly interpolates the compiled function name: The compileShellApiFunctionName in packages/tools/src/packageTools.ts (line 30-35) performs no validation: Two injection vectors: 1. Without @: The entire functionName is appended after dbgateApi. without sanitization 2. With @: The part before @…
Recommended action: Upgrade to 7.1.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DbGate is vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint. The require = null mitigation is trivially bypassed via dynamic import(). <br/ Details Code injection via functionName in loadReader The /runners/load-reader endpoint interpolates the functionName parameter directly into a dynamically generated JavaScript script template without any sanitization: By injecting a newline character into functionName, an attacker breaks out of the template expression and injects arbitrary JavaScript code. The injected code uses await import('childprocess') to bypass the require = null mitigation (since import() is a language keyword, not a function that can be nullified), achieving arbitrary command execution as the process user (root in Docker). The June 2025 security fix (commit cf3f95c) added require = null to…
Recommended action: Upgrade to 7.1.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.