Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

dbgate-serve

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 10.0npmAmendedPublished

    DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

    CVE-2026-47668 · GHSA-8v3q-9vmx-36vc

    Affected
    • npm dbgate-serve <= 7.1.8
    Fixed in
    7.1.9· Vendor fix available
    Issue
    DbGate's JSON script runner (POST /runners/start) allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Details Step 1: User Input Entry Point File: packages/api/src/controllers/runners.js - start() method The /runners/start endpoint accepts a POST body containing a script object. When script.type == 'json', the request follows a different code path than raw shell scripts: This path skips: 1. The run-shell-script permission check 2. The allowShellScripting platform-level check The only validation performed is checkSecureDirectoriesInScript(), which props.fileName values --- Step 2: JSON-to-JavaScript Conversion (Injection Point) File: packages/tools/src/ScriptWriter.ts - assignCore() method The JSON script's commands array…

    Recommended action: Upgrade to 7.1.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →