The vulnerability allows an authenticated user with basic access to inject arbitrary JavaScript code through the functionName parameter in the POST /runners/load-reader endpoint. Because the code is directly interpolated without sanitization, it runs on the server with the full Node.js process privileges, bypassing the sandbox. This leads to remote code execution, allowing execution of OS commands, file read/write, and database credential extraction, effectively compromising the host system.

All installations of DbGate version 7.1.8 and earlier are affected. The issue exists in the cross‑platform database manager, running under Node.js, and is accessible in Docker deployments where it can grant root within the container. The attacker only needs authenticated access with basic privileges, no admin role required.

The CVSS score of 8.8 indicates a high severity vulnerability with complete confidentiality, integrity, and availability compromise. The EPSS score of less than 1% shows that exploitation risk is currently low, and the vulnerability is not listed in CISA KEV, suggesting no known large‑scale active exploitation. Nonetheless, the attacker can perform the exploit remotely via an authenticated HTTP request, so patches should be applied promptly.