https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 03:57:21 +0000 https://vulnerability.circl.lu/vuln/bdu:2026-10981 bdu:2026-10981 https://vulnerability.circl.lu/vuln/bdu:2026-10981 https://vulnerability.circl.lu/vuln/fkie_cve-2026-47668 <p>DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate&#39;s JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.</p> <p>DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate&#39;s JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-47668 https://vulnerability.circl.lu/vuln/ghsa-8v3q-9vmx-36vc <p><strong>Affected:</strong> npm: dbgate-serve</p> <p>### Summary DbGate&#39;s JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process.</p> <p>### Details #### Step 1: User Input Entry Point</p> <p>**File:** `packages/api/src/controllers/runners.js` - `start()` method</p> <p>The `/runners/start` endpoint accepts a POST body containing a `script` object. When `script.type == &#39;json&#39;`, the request follows a different code path than raw shell scripts:</p> <p>```javascript async start({ script }, req) { if (script.type == &#39;json&#39;) { if (!platformInfo.isElectron) { if (!checkSecureDirectoriesInScript(script)) { return { errorMessage: &#39;Unallowed directories in script&#39; }; } } logJsonRunnerScript(req, script); const js = await jsonScriptToJavascript(script); return this.startCore(runid, scriptTemplate(js, false)); } ``` This path skips: 1. The `run-shell-script` permission check 2. The `allowShellScripting` platform-level check</p> <p>The only validation performed is `checkSecureDirectoriesInScript()`, which `props.fileName` values</p> <p>---</p> <p>#### Step 2: JSON-to-JavaScript Conversion (Injection Point)</p> <p>**File:** `packages/tools/src/ScriptWriter.ts` - `assignCore()` method</p> <p>The JSON script&#39;s `comma…</p> <p><strong>Affected:</strong> npm: dbgate-serve</p> <p>### Summary DbGate&#39;s JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process.</p> <p>### Details #### Step 1: User Input Entry Point</p> <p>**File:** `packages/api/src/controllers/runners.js` - `start()` method</p> <p>The `/runners/start` endpoint accepts a POST body containing a `script` object. When `script.type == &#39;json&#39;`, the request follows a different code path than raw shell scripts:</p> <p>```javascript async start({ script }, req) { if (script.type == &#39;json&#39;) { if (!platformInfo.isElectron) { if (!checkSecureDirectoriesInScript(script)) { return { errorMessage: &#39;Unallowed directories in script&#39; }; } } logJsonRunnerScript(req, script); const js = await jsonScriptToJavascript(script); return this.startCore(runid, scriptTemplate(js, false)); } ``` This path skips: 1. The `run-shell-script` permission check 2. The `allowShellScripting` platform-level check</p> <p>The only validation performed is `checkSecureDirectoriesInScript()`, which `props.fileName` values</p> <p>---</p> <p>#### Step 2: JSON-to-JavaScript Conversion (Injection Point)</p> <p>**File:** `packages/tools/src/ScriptWriter.ts` - `assignCore()` method</p> <p>The JSON script&#39;s `comma…</p> https://vulnerability.circl.lu/vuln/ghsa-8v3q-9vmx-36vc