CVE-2026-48017

CVE-2026-48017 — Remote Code Execution in DbGate via functionName injection Severity : High CVSS 8.8 CWE : CWE-94 — Improper Control of Generation of Code 'Code Injection' Affected : dbgate-api ≤ 7.1.8 patched in 7.1.9 Advisory : GHSA-hv83-ggc4-v385 NVD :...

dbgate (>=3.9.6-alpha.9, <=4.7.4-alpha.12), dbgate-serve (>=4.1.1, <=7.1.8) +1 more potentially affected by CVE-2026-47670 via dbgate-api (>=3.9.6, <=7.1.8)

dbgate-api NPM version =3.9.6, =3.9.6-alpha.9, =4.1.1, =5.2.2-alpha.11, =7.1.8 Source cves: CVE-2026-47670 Source advisory: MEND:CVE-2026-47670...

dbgate (>=3.9.6-alpha.9, <=4.7.4-alpha.12), dbgate-serve (>=4.1.1, <=7.1.8) +1 more potentially affected by CVE-2026-48017 via dbgate-api (>=3.9.6, <=7.1.8)

dbgate-api NPM version =3.9.6, =3.9.6-alpha.9, =4.1.1, =5.2.2-alpha.11, =7.1.8 Source cves: CVE-2026-48017 Source advisory: MEND:CVE-2026-48017...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-48017 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-48017 Source advisory: SNYK:JS-DBGATEAPI-17223766...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-48017 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-48017 Source advisory: GHSA-HV83-GGC4-V385...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-48017 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-48017 Source advisory: OSV:GHSA-HV83-GGC4-V385...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-47670 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-47670 Source advisory: GHSA-WM5R-5QP3-5VXF...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-47670 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-47670 Source advisory: OSV:GHSA-WM5R-5QP3-5VXF...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-47669 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-47669 Source advisory: SNYK:JS-DBGATEAPI-17817001...

Insecure Default Initialization of Resource

Overview dbgate-api is an Allows run DbGate data-manipulation scripts. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the functionName parameter in JSON script assign commands, which is interpolated directly into dynamically generated JavaScrip...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-47668 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-47668 Source advisory: SNYK:JS-DBGATEAPI-17817037...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-47670 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-47670 Source advisory: SNYK:JS-DBGATEAPI-17223765...

Command Injection

Overview dbgate-api is an Allows run DbGate data-manipulation scripts. Affected versions of this package are vulnerable to Command Injection via the functionName parameter in the /runners/load-reader endpoint. An attacker can execute arbitrary operating system commands as the process user root in...

dbgate-api (>=7.1.3-alpha.2, <=7.1.4), dbgate-api-premium (>=7.1.3-alpha.2, <=7.1.4) +3 more potentially affected by CVE-2026-6215 via dbgate-rest (>=7.1.3-alpha.2, <=7.1.4)

dbgate-rest NPM version =7.1.3-alpha.2, =7.1.3-alpha.2, =7.1.3-alpha.2, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.4 Source cves: CVE-2026-6215 Source advisory: MEND:CVE-2026-6215...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview dbgate-api is an Allows run DbGate data-manipulation scripts. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via insufficient validation of file paths and types in the reader function. An attacker can access arbitrary files on the...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview dbgate-api is an Allows run DbGate data-manipulation scripts. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via the file parameter in the /uploads/get endpoint. An attacker can access arbitrary files on the system by supplying a...

dbgate (>=3.9.6-alpha.9, <=4.7.4-alpha.12), dbgate-serve (>=4.1.1, <=5.5.7-alpha.68) +1 more potentially affected by CVE-2025-50184 via dbgate-api (>=3.9.6, <=5.5.7-alpha.68)

dbgate-api NPM version =3.9.6, =3.9.6-alpha.9, =4.1.1, =5.2.2-alpha.11, =5.5.7-alpha.68 Source cves: CVE-2025-50184 Source advisory: MEND:CVE-2025-50184...