CVE-2026-48017: DbGate: Remote Code Execution via functionName injection in loadReader endpoint

Synopsis

Remote code execution via JavaScript injection in DbGate, a cross-platform database manager. The POST /runners/load-reader endpoint accepts a functionName parameter that is interpolated directly into a JavaScript code template without sanitization, reachable over the network by any authenticated user with basic access. Successful exploitation gives the attacker full code execution on the server, arbitrary file read/write, access to stored database credentials, and in Docker environments typically root access within the container. No patched version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the DbGate HTTP service to send the malicious POST request.

• AuthenticationRequired

  Any low-privilege account is sufficient; no admin role or special permission is needed, just a valid authenticated session.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly; no action is required from another user or administrator.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; the payload is injected directly into an unsanitized template parameter with no race conditions or environmental dependencies.

Blast Radius

• Executes arbitrary OS commands on the DbGate server with the privileges of the Node.js process.
• Reads and writes any file accessible to that process, including configuration files and secrets stored on disk.
• Reads stored database connection credentials from DbGate's internal storage, enabling pivot attacks against every connected database.
• In Docker deployments, typically achieves root access within the container, with further escalation potential depending on container configuration.