CVE-2026-48017 DbGate: Remote Code Execution via functionName injection in loadReader endpoint
Authenticated users can inject JavaScript into the loadReader endpoint to execute arbitrary code and commands on the DbGate server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48017?
CVE-2026-48017 is a high-severity code injection vulnerability in dbgate, published on 15 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with full process privileges, bypassing the require=null sandbox restriction. An authenticated user with basic access (no admin role, no run-shell-script permission required) can: execute arbitrary OS commands on the DbGate server with the privileges of the Node.js process, read/write any file accessible to the process, pivot to connected databases by reading connection credentials from DbGate's storage, and compromise the host system - in Docker deployments, this typically means root access within the container. Version 7.1.9 contains a patch.
Weakness: CWE-94
Which versions are affected by CVE-2026-48017?
2 open source packages ship an affected version, including dbgate-api.
| Package | Affected | Fixed in |
|---|---|---|
dbgate-api npm | All versions | 7.1.9 |
dbgate-api npm | All versions | 7.1.9 |
How do I fix CVE-2026-48017?
Upgrade dbgate-api to 7.1.9 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-48017 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48017 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-hv83-ggc4-v385.