CVE-2026-47670

9.4 criticalEPSS 1.8%

Critical (9.4). EPSS 1.8% chance of exploitation in the next 30 days. Fixed in dbgate-api 7.1.9.

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. Version 7.1.9 contains a patch.

Severity

CVSS 4.0

9.4 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

EPSS: 1.8% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-78
Published: 2026-07-23
Modified: 2026-07-28
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-wm5r-5qp3-5vxf	npm	dbgate-api	<7.1.9	7.1.9

References

https://github.com/dbgate/dbgate/releases/tag/v7.1.9
https://github.com/dbgate/dbgate/security/advisories/GHSA-wm5r-5qp3-5vxf

Check your stack JSON