2vulnerabilities
- Critical1 (50.0%)
- High1 (50.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
dbgate-api
Ecosystem: npm
Downloads:
- 1CriticalAffects 1 version
- 1HighAffects 1 version
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 2 vulnerabilities
- Critical: 1
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting dbgate-api, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-hv83-ggc4-v385 | High | DbGate: Remote Code Execution via functionName injection in loadReader endpoint### Summary The `POST /runners/load-reader` endpoint in DbGate accepts a `functionName` parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with full process privileges, bypassing the `require=null` sandbox restriction. ### Details The `loadReader` endpoint in `packages/api/src/controllers/runners.js` (line 353) takes a `functionName` parameter from the request body and passes it to `compileShe |
| GitHub (opens in a new tab) | |
| GHSA-wm5r-5qp3-5vxf | Critical | Authenticated Remote Code Execution via loadReader functionName code injection in DbGate### Summary DbGate is vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. <br/> ### Details **Code injection via `functionName` in loadReader** The `/runners/load-reader` endpoint interpolates the `functionName` parameter directly into a dynamically generated JavaScript script template without any sanitization: ```javascript // packa |
| GitHub (opens in a new tab) |
- GHSA-hv83-ggc4-v385HighDbGate: Remote Code Execution via functionName injection in loadReader endpoint
< 7.1.9
### Summary The `POST /runners/load-reader` endpoint in DbGate accepts a `functionName` parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with full process privileges, bypassing the `require=null` sandbox restriction. ### Details The `loadReader` endpoint in `packages/api/src/controllers/runners.js` (line 353) takes a `functionName` parameter from the request body and passes it to `compileShe
CVE: CVE-2026-48017
- GHSA-wm5r-5qp3-5vxfCriticalAuthenticated Remote Code Execution via loadReader functionName code injection in DbGate
< 7.1.9
### Summary DbGate is vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized `functionName` parameter in the `/runners/load-reader` endpoint. The `require = null` mitigation is trivially bypassed via dynamic `import()`. <br/> ### Details **Code injection via `functionName` in loadReader** The `/runners/load-reader` endpoint interpolates the `functionName` parameter directly into a dynamically generated JavaScript script template without any sanitization: ```javascript // packa
CVE: CVE-2026-47670