{"items":[{"id":"NVI-00018286","kind":"vulnerability","title":"Authenticated Remote Code Execution via loadReader functionName code injection in DbGate","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-wm5r-5qp3-5vxf","CVE-2026-47670"],"plain_summary":"GitHub lists this reviewed advisory for dbgate-api. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-060e0998631fd42c26465889c39da366"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-060e0998631fd42c26465889c39da366","url":"https://github.com/advisories/GHSA-wm5r-5qp3-5vxf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-wm5r-5qp3-5vxf","publisher":"GitHub Advisory Database","observed_at":"2026-11-07T00:52:58.259Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-060e0998631fd42c26465889c39da366"],"technology":"dbgate-api","known_exclusions":[],"conditions_summary":"### Summary\n\nDbGate is vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`.\n\n\n\n\n### Details\n\n**Code injection via `functionName` in loadReader**\n\nThe `/runners/load-reader` endpoint interpolates the `functionName` parameter directly into a dynamically generated JavaScript script template without any sanitization:\n\n```javascript\n// packages/api/src/controllers/runners.js (loadReader / loaderScriptTemplate)\nconst reader = await dbgateApi.${functionName}({...});\n```\n\nBy injecting a newline character into `functionName`, an attacker breaks out of the template expression and injects arbitrary JavaScript code. The injected code uses `await import('child_process')` to bypass the `require = null` mitigation (since `import()` is a language keyword, not a function that can be nullified), achieving arbitrary command execution as the process user (root in Docker).\n\nThe June 2025 security fix ([commit cf3f95c](https://github.com/dbgate/d","public_affected_ranges":["<= 7.1.8"]}],"null_published_at":"2026-11-07T07:07:39.801Z","source_updated_at":"2026-06-05T16:31:03.000Z","source_disclosed_at":"2026-06-05T16:30:59.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-07T00:52:58.259Z"}],"next_cursor":null,"snapshot_revision":"42594"}