{"action":"Upgrade dbgate-serve to 7.1.9 or later.","affected":[{"fixed":"7.1.9","introduced":"0"}],"component":"dbgate-serve","cve_ids":["CVE-2026-47668"],"ecosystem":"npm","epss":0.03882,"exploited":false,"fixed_versions":["7.1.9"],"ghsa_id":"GHSA-8v3q-9vmx-36vc","id":"tcs_01M5KFDZJM0TV7YQ3RG1G2PCXE","modified_at":"2026-06-05T16:41:31.482315Z","published_at":"2026-06-05T16:25:23Z","references":["https://osv.dev/vulnerability/GHSA-8v3q-9vmx-36vc","https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc","https://github.com/dbgate/dbgate","https://github.com/dbgate/dbgate/releases/tag/v7.1.9","https://github.com/runZeroInc/nuclei-templates/blob/main/http/vulnerabilities/dbgate-unauth-rce.yaml"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-8v3q-9vmx-36vc","url":"https://osv.dev/vulnerability/GHSA-8v3q-9vmx-36vc"}],"summary":"DbGate: Unauthenticated Remote Code Execution via JSON Script Runner"}