CVE-2026-97225

DbGate JSON Runner runners.js code injection

View on CVE.org
Published Sep 24, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from remote. Upgrading to version 7.2.5-beta.6 mitigates this issue. This patch is called 70e7b6b58e464d7a015ba16e8d7574b420ee4877. Upgrading the affected component is advised. This issue is distinct from CVE-2026-47668.

Analysis

AI-generated

Technical impact

A flaw in the JSON Runner component of DbGate allows an attacker to manipulate the comment.text or script.schedule arguments in the runners.js controller. This manipulation leads to code injection, which can result in arbitrary code execution on the host running the application. The vulnerability is a classic injection (CWE‑74) and code generation (CWE‑94) weakness.

Affected Systems

The vulnerability affects all builds of DbGate up to version 7.2.5‑beta.5 that include the JSON Runner component. Any deployment using this component prior to the 7.2.5‑beta.6 release is potentially exposed.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is <1%, indicating a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. The vulnerability can be exploited remotely by manipulating the comment.text or script.schedule parameters; however, the description does not detail the specific mechanism, so this is inferred as a potential remote entry point.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the DbGate component to version 7.2.5‑beta.6 or later, which includes the fix commit 70e7b6b58e464d7a015ba16e8d7574b420ee4877.
  • Implement input validation or sandboxing for comment.text and script.schedule parameters to mitigate injection weaknesses, ensuring only allowed patterns are accepted.
  • Restrict API access to authenticated and authorized users, and limit network connectivity to the DbGate instance to trusted internal hosts or networks.

Generated by OpenCVE AI on September 26, 2026 at 03:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from remote. Upgrading to version 7.2.5-beta.6 mitigates this issue. This patch is called 70e7b6b58e464d7a015ba16e8d7574b420ee4877. Upgrading the affected component is advised. This issue is distinct from CVE-2026-47668.
Title DbGate JSON Runner runners.js code injection
First Time appeared Dbgate
Dbgate dbgate
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:dbgate:dbgate:*:*:*:*:*:*:*:*
Vendors & Products Dbgate
Dbgate dbgate
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 25, 2026, 2:20 PM
Reserved
Sep 24, 2026, 9:53 AM

View source JSON

Updated
Sep 25, 2026, 2:20 PM

JSON

Status
Deferred
Published
Sep 24, 2026, 4:17 PM
Modified
Sep 25, 2026, 3:17 PM

View source JSON

No data.

Updated
Sep 26, 2026, 3:15 AM

JSON