Description
A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from remote. Upgrading to version 7.2.5-beta.6 mitigates this issue. This patch is called 70e7b6b58e464d7a015ba16e8d7574b420ee4877. Upgrading the affected component is advised. This issue is distinct from CVE-2026-47668.
Published: 2026-09-24
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

A flaw in the JSON Runner component of DbGate allows an attacker to manipulate the comment.text or script.schedule arguments in the runners.js controller. This manipulation leads to code injection, which can result in arbitrary code execution on the host running the application. The vulnerability is a classic injection (CWE‑74) and code generation (CWE‑94) weakness.

Affected Systems

The vulnerability affects all builds of DbGate up to version 7.2.5‑beta.5 that include the JSON Runner component. Any deployment using this component prior to the 7.2.5‑beta.6 release is potentially exposed.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is <1%, indicating a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. The vulnerability can be exploited remotely by manipulating the comment.text or script.schedule parameters; however, the description does not detail the specific mechanism, so this is inferred as a potential remote entry point.

Generated by OpenCVE AI on September 26, 2026 at 03:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the DbGate component to version 7.2.5‑beta.6 or later, which includes the fix commit 70e7b6b58e464d7a015ba16e8d7574b420ee4877.
  • Implement input validation or sandboxing for comment.text and script.schedule parameters to mitigate injection weaknesses, ensuring only allowed patterns are accepted.
  • Restrict API access to authenticated and authorized users, and limit network connectivity to the DbGate instance to trusted internal hosts or networks.

Generated by OpenCVE AI on September 26, 2026 at 03:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from remote. Upgrading to version 7.2.5-beta.6 mitigates this issue. This patch is called 70e7b6b58e464d7a015ba16e8d7574b420ee4877. Upgrading the affected component is advised. This issue is distinct from CVE-2026-47668.
Title DbGate JSON Runner runners.js code injection
First Time appeared Dbgate
Dbgate dbgate
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:dbgate:dbgate:*:*:*:*:*:*:*:*
Vendors & Products Dbgate
Dbgate dbgate
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Dbgate Dbgate
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-25T14:20:57.023Z

Reserved: 2026-09-24T09:53:17.836Z

Link: CVE-2026-97225

cve-icon Vulnrichment

Updated: 2026-09-25T14:20:53.954Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T16:17:28.880

Modified: 2026-09-25T15:17:57.237

Link: CVE-2026-97225

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T03:15:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')