CVE-2026-47668 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-47668 requires immediate attention.

· 6 min read

Executive Summary

CVE-2026-47668 is a critical remote code execution flaw in npm dbgate-serve affecting DbGate’s JSON script runner. A crafted request to POST /runners/start can inject JavaScript through the functionName field in JSON assign commands, leading to arbitrary command execution in a Node.js child process. In default-style deployments where authentication is not explicitly hardened, this may be reachable with little or no access control.

Fix is available in v7.1.9. If you run DbGate in production, treat this as an urgent patch-and-restart issue. If you cannot patch immediately, isolate the service, block access to runner endpoints, and disable any exposed API access until remediation is complete.

Immediate Action

  • Upgrade immediately to the fixed release: dbgate-serve@7.1.9 or later. If you use a Docker image, move to a tag that includes the fix.
  • Restrict network access to the DbGate API now. Block inbound access to /runners/start and related runner endpoints at the reverse proxy, firewall, or ingress layer.
  • Disable anonymous access if enabled. Require strong authentication and confirm it is not falling back to default/anonymous mode.
  • Isolate the service from sensitive networks until patched. Assume an attacker who can reach the endpoint can execute OS commands.
  • Rotate secrets if the service was exposed. Review environment variables, API tokens, database credentials, and any credentials stored on the host.
  • Check the vendor advisory or release notes here: DbGate security advisory / release notes.

Affected Versions

  • dbgate-serve versions before 7.1.9 are vulnerable.
  • dbgate-serve@<=7.1.8 vulnerable; upgrade to 7.1.9+.
  • If you pin a Docker image, any image built from a vulnerable release is affected until rebuilt or retagged to a fixed version.
  • Safe version: dbgate-serve@7.1.9 or later.

Resolution Guide

JavaScript / npm

npm install dbgate-serve@7.1.9
# or
npm install -D dbgate-serve@7.1.9

Yarn

yarn add dbgate-serve@7.1.9
# or
yarn upgrade dbgate-serve@7.1.9

pnpm

pnpm add dbgate-serve@7.1.9
# or
pnpm up dbgate-serve@7.1.9

Docker

docker pull <vendor/dbgate-serve:7.1.9>
docker stop dbgate
docker rm dbgate
docker run -d --name dbgate <vendor/dbgate-serve:7.1.9>

Linux package managers (if your environment wraps the app in a system package)

apt-get update
apt-get install --only-upgrade dbgate-serve

yum update dbgate-serve
dnf update dbgate-serve

Hardening steps

# Block runner endpoints at your reverse proxy / gateway
# Example Nginx rule:
location ~ ^/runners/ {
  deny all;
  return 403;
}

# Ensure auth is not anonymous/default
# TODO: set explicit auth provider and credentials in your deployment config
# Example placeholder:
# AUTH_PROVIDER=local
# AUTH_REQUIRED=true

Minimal code fix example if you maintain a fork: stop concatenating untrusted values into generated JavaScript. Validate against an allowlist and use safe mapping instead of raw interpolation.

// Before: unsafe
this._put(`const ${variableName} = await ${functionName}(${JSON.stringify(props)});`);

// After: allowlist-based example
const safeFn = allowedFunctions[functionName];
if (!safeFn) throw new Error("Invalid functionName");
if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(variableName)) throw new Error("Invalid variableName");
this._put(`const ${variableName} = await ${safeFn}(${JSON.stringify(props)});`);

Detection & Verification

Check installed version

npm ls dbgate-serve
node -p "require('dbgate-serve/package.json').version"

Check container/image version

docker image inspect <image> --format '{{.RepoTags}} {{.Id}}'
docker exec -it <container> node -p "require('/path/to/package.json').version"

Look for vulnerable code patterns in custom forks or vendored copies:

grep -R "assignCore(variableName, functionName" -n .
grep -R "compileShellApiFunctionName" -n .
grep -R "POST /runners/start\|load-reader" -n .

Verify the fix

npm audit --production
npm ls dbgate-serve
curl -s -o /dev/null -w "%{http_code}\n" http://<host>:3000/runners/start

Confirm the service returns 403 or another blocked response for unauthorized access, and that the installed package reports 7.1.9 or later.

Risk and Impact

This bug can turn a simple API request into full server compromise. An attacker who reaches the runner endpoint may execute arbitrary Node.js code, read environment secrets, launch outbound connections, and run OS commands with the privileges of the DbGate process. In a small-team setup, that can mean database credentials, cloud keys, and internal network access are all at risk.

Because the vulnerable path runs in a forked Node.js process, the blast radius can extend beyond the application itself to the host and any reachable services. Even if you believe the instance is “internal only,” treat it as exposed if any user, token, proxy, or default auth mode can reach the API.

Keep reading