DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

published 2026-06-05 5 mo ago modified 2026-07-28 3 mo ago also GHSA-wm5r-5qp3-5vxf , EUVD-2026-48376

cvss: 9.4; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits: 0; none known, plus a Nuclei check

DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. Version 7.1.9 contains a patch.

Patch / fix

fixed in 1 links 1

npm dbgate-api 7.1.9

github.com/dbgate/dbgate/releases/tag/v7.1.9 release

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 3 mo ago (2026-07-24)

Exploit prediction

1.76% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Nuclei template DbGate - Remote Code Execution via Dynamic Import Bypass nuclei detection template

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA	4.0	9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
npm	dbgate-api	<7.1.9	7.1.9

Affected products

dbgate dbgate

Classification

Weakness

CWE-77 Improper Neutralization of Special Elements used in a Command
CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary