CVE-2026-47668: DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

Advisories.Gitlab • June 6, 2026

DbGate’s JSON script runner ( POST /runners/start ) allows remote code execution via code injection in the functionName parameter of JSON script assign commands. The functionName value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-47668: Unauthenticated RCE Vulnerability in DbGate DbGate's JSON script runner has a critical vulnerability (CVE-2026-47668) that allows unauthenticated remote code execution via the functionName parameter in JSON script assign commands. The vulnerability arises from direct string concatenation of user-controlled values into dynamically generated JavaScript code, which is executed in a forked Node.js child process. The flaw affects systems using the default deployment settings, where authentication is disabled, allowing attackers to exploit the vulnerability without credentials. If exploited, attackers gain full Node.js runtime access, including built-in modules. The CVSS score for this vulnerability is 10.0, indicating a critical risk. Organizations using DbGate are urged to review their deployment settings and implement necessary security measures. The vulnerability was disclosed on June 6, 2026, and is currently under active scrutiny. 2 sources 86

Extracted Entities

CVE-2026-47668: DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Tools (1)