Description
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dbgate | dbgate | < 7.1.9 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
Nxploited/CVE-2026-47668 ★ 6 · May 26, 2026
DbGate Unauthenticated Remote Code Execution
-
s-vx/CVE-2026-47668 ★ 0 · Jul 31, 2026
Unauthenticated RCE in DBGate <= 7.1.8
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- DbGate - Remote Code Execution via Anonymous JWT http/cves/2026/CVE-2026-47668.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | dbgate-serve | < 7.1.9 | 7.1.9 | GHSA-8v3q-9vmx-36vc |