CVE-2026-47668
DbGate: Unauthenticated Remote Code Execution via JSON Script Runner
- Published
- Jul 23, 2026
- Updated
- Jul 24, 2026
- Assigning CNA
- GitHub_M
- Evidence observed
- Aug 17, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HLow · next 30 days
- Percentile
- 90.1%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.
Sources
http/cves/2026/CVE-2026-47668.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)
- oob: interactsh_reference($.template_text)
- CVE-2026-47668Exploit
DbGate Unauthenticated Remote Code Execution
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.