Loading vulnerability…
CVE-2026-47668 is a remote code execution vulnerability in DbGate, a cross-platform database manager. Affected versions are 7.1.8 and earlier. The flaw resides in the JSON script runner exposed through the POST /runners/start endpoint, where the functionName parameter of JSON script assign commands is incorporated into dynamically generated JavaScript source code through unsafe string concatenation. That generated JavaScript is then executed in a forked Node.js child process. Because attacker-controlled input is embedded into executable code without proper neutralization, an attacker can inject arbitrary JavaScript and achieve remote code execution on the host running DbGate. Available reporting also indicates variableName may be involved in the unsafe code generation path.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository is a small standalone proof-of-concept/test environment for exploiting rclone remote control command injection/RCE. Structure: (1) rce.py is the main exploit and only substantive code; it uses Python requests to POST attacker-controlled form data to the rclone RC API endpoint /operations/fsinfo. The malicious fs parameter declares a :webdav backend and injects a bearer_token_command value containing a URL-encoded bash -c command. A random uuid is added so repeated requests are re-executed. Two execution modes are implemented: a default 'dirty' mode that captures command output by piping stderr/stdout through base64 and parsing the encoded data from the JSON error string, and a blind mode that executes commands while forcing a benign exit path. (2) Containerfile builds a Debian-based lab image, downloads/install rclone 1.73.3, and starts rclone rcd bound to 0.0.0.0:5572. (3) run.sh builds and runs the container with Podman and publishes port 5572. (4) shell.sh opens an interactive shell in the running container. README identifies the repo as a test environment and references the advisory. Overall purpose: provide a reproducible local lab plus an operational Python exploit for unauthenticated or weakly exposed rclone RC services vulnerable to backend option command injection, yielding arbitrary command execution.
Repository contains a single substantial Python exploit tool, CVE-2026-47668.py, plus README, LICENSE, and requirements.txt. The script targets CVE-2026-47668, an unauthenticated/weakly authenticated remote code execution issue in DbGate/dbgate-serve <= 7.1.8 caused by unsafe embedding of user-controlled functionName and variableName fields into dynamically generated JavaScript for the JSON script runner. The exploit is not tied to a common framework; it is a standalone asyncio/aiohttp-based assessment and exploitation utility. Main capabilities: it normalizes target URLs, supports single-target and mass-target modes, attempts authentication via POST /auth/login to obtain a Bearer token when needed, probes the vulnerable runner, and sends an injected payload to POST /runners/start. It can execute arbitrary OS commands in the Node.js runner child process, collect output through an attacker-controlled HTTP callback listener, optionally base64-encode exfiltrated output, and optionally trigger a reverse TCP shell for single-target use. It also supports concurrency, timeout tuning, TLS verification control, vector selection (functionName, variableName, or both), and session/result logging. Operational structure: the script initializes an Nx/ output tree, including vuln.txt, dispatch.txt, revsh.txt, exfil.txt, failed.txt, list_report.txt, per-target exfil files, and session summaries. It includes CLI and wizard-style execution paths, built-in HTTP listener support for callbacks, reverse-shell listener configuration, and helper routines for URL normalization and target bookkeeping. README documents workflow as login -> probe -> POST /runners/start -> classify result as FAIL, VULN, DISPATCH, EXFIL, or REVSH. Fingerprintable targets/endpoints are primarily the DbGate web endpoints POST /auth/login and POST /runners/start, along with local output paths under Nx/. Default network assumptions include DbGate on port 3000, HTTP callback listener on port 8888, and reverse shell listener on port 4444. Overall, this is a real operational exploit/assessment tool with practical payload delivery and output confirmation, not merely a detector.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in DbGate's JSON script runner affecting versions prior to 7.1.9, caused by code injection through the `functionName` parameter that is concatenated into generated JavaScript and executed in a Node.js child process.
The content only references updates to a YAML file for CVE-2026-47668 and does not describe the underlying vulnerability or its significance.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.