DbGate is a cross‑platform database manager. In versions 7.1.8 and earlier, its JSON script runner allows remote code execution by injecting code into the functionName parameter of assign commands within JSON scripts. The functionName is concatenated into JavaScript source code that is then executed in a Node.js child process. This leads to arbitrary code execution on the host, granting an attacker full control and the ability to exfiltrate data or disrupt services. The weakness is a combination of unsafe string handling (CWE-1188), lack of input validation (CWE-20), and a code‑generation vulnerability (CWE-94).

The flaw exists in DbGate versions 7.1.8 and earlier. The affected vendor is dbgate, product dbgate. A user should verify if they run a vulnerable build and consider updating.

The CVSS score of 10 indicates critical severity. The EPSS score of 4% suggests a moderate exploitation probability. The vulnerability is not yet published in the CISA KEV catalog, but its remote nature and high impact make it a priority to remediate. Attackers can exploit the flaw via an unauthenticated HTTP POST to /runners/start, sending a malformed JSON payload containing a malicious functionName. The code is then executed on the system, potentially compromising confidentiality, integrity, and availability.