CVE-2026-47668: Unauthenticated RCE Vulnerability in DbGate

DbGate's JSON script runner has a critical vulnerability (CVE-2026-47668) that allows unauthenticated remote code execution via the functionName parameter in JSON script assign commands. The vulnerability arises from direct string concatenation of user-controlled values into dynamically generated JavaScript code, which is executed in a forked Node.js child process. The flaw affects systems using the default deployment settings, where authentication is disabled, allowing attackers to exploit the vulnerability without credentials. If exploited, attackers gain full Node.js runtime access, including built-in modules. The CVSS score for this vulnerability is 10.0, indicating a critical risk. Organizations using DbGate are urged to review their deployment settings and implement necessary security measures. The vulnerability was disclosed on June 6, 2026, and is currently under active scrutiny.

Key Points: • CVE-2026-47668 allows unauthenticated remote code execution in DbGate. • The vulnerability is due to unsafe string interpolation in JavaScript code generation. • Default deployment settings may expose systems to exploitation without authentication.