A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection.
The attack may be performed from remote. Upgrading to version 7.2.5-beta.6 mitigates this issue. This patch is called 70e7b6b58e464d7a015ba16e8d7574b420ee4877.
Upgrading the affected component is advised. This issue is distinct from CVE-2026-47668.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 8
https://github.com/dbgate/dbgate/
cna@vuldb.com
https://github.com/dbgate/dbgate/commit/70e7b6b58e464d7a015ba16e8d7574b420ee4877
cna@vuldb.com
https://github.com/dbgate/dbgate/pull/1527
cna@vuldb.com
https://github.com/dbgate/dbgate/releases/tag/v7.2.5-beta.6
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-97225
cna@vuldb.com
https://vuldb.com/submit/908099
cna@vuldb.com
https://vuldb.com/vuln/409319
cna@vuldb.com
https://vuldb.com/vuln/409319/cti
cna@vuldb.com