Critical severityNVD Advisory· Published Jul 23, 2026· Updated Jul 28, 2026
CVE-2026-47670
CVE-2026-47670
Description
DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint. The require = null mitigation is trivially bypassed via dynamic import(). Version 7.1.9 contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
dbgate-apinpm | < 7.1.9 | 7.1.9 |
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.