The vulnerability resides in DbGate’s POST /runners/load-reader endpoint. In versions 7.1.8 and earlier, the endpoint accepts a functionName parameter that is interpolated verbatim into a JavaScript code template without any filtering. Because authentication is required but only basic access is needed, any authenticated user can pass malicious JavaScript. That code runs with the full Node.js process privileges, bypassing the sandbox established by require=null. As a result, an attacker can execute arbitrary OS commands on the host, read or write any file accessible to the process, obtain database credentials stored by DbGate, and ultimately compromise the host system. In Docker deployments this equates to root access inside the container.

All installations of DbGate version 7.1.8 and earlier are affected. The issue exists in the cross‑platform database manager, running under Node.js, and is accessible in Docker deployments where it can grant root within the container. The attacker only needs authenticated access with basic privileges, no admin role required.

The CVSS score of 8.8 indicates a high severity vulnerability with complete confidentiality, integrity, and availability compromise. The EPSS score of less than 1% shows that exploitation risk is currently low, and the vulnerability is not listed in CISA KEV, suggesting no known large‑scale active exploitation. Nonetheless, the attacker can perform the exploit remotely via an authenticated HTTP request, so patches should be applied promptly.