All vulnerabilities
CVE-2026-97225

DbGate JSON Runner runners.js code injection

n/a DbGate
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published24 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from remote. Upgrading to version 7.2.5-beta.6 mitigates this issue. This patch is called 70e7b6b58e464d7a015ba16e8d7574b420ee4877. Upgrading the affected component is advised. This issue is distinct from CVE-2026-47668.

Text from CVE List

Affected versions 7

  • DbGateaffected: 7.2.5-beta.0CVE List
  • DbGateaffected: 7.2.5-beta.1CVE List
  • DbGateaffected: 7.2.5-beta.2CVE List
  • DbGateaffected: 7.2.5-beta.3CVE List
  • DbGateaffected: 7.2.5-beta.4CVE List
  • DbGateaffected: 7.2.5-beta.5CVE List
  • DbGateunaffected: 7.2.5-beta.6CVE List

References 8