DbGate EUVD-2026-85932

Requires an authenticated DbGate user (PR:L) able to reach the API and control the comment.text or script.schedule argument of the JSON Runner / scheduler feature - i.e., a user who can create or edit a runner/scheduled script's comment or schedule fields. Exploitation is remote and needs no user interaction, but is limited to versions up to 7.2.5-beta.5 (fixed in 7.2.5-beta.6) and gated by DbGate's permission model. The condition is that unsanitized comment/schedule text is passed to ScriptWriter and executed; deployments where untrusted or lower-privilege accounts can submit these fields are most exposed.

This is CVE-2026-97225, a CWE-94 code-injection flaw in DbGate's JSON Runner (packages/api/src/controllers/runners.js) affecting versions up to 7.2.5-beta.5. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, base 5.3, E:X) treats this as network-reachable and authenticated (PR:L) with only LOW impact across all three dimensions. I DISPUTE the low impact rating: the source-code evidence shows user-controlled comment.text and @schedule text is embedded into a generated JavaScript script that DbGate then executes server-side, and the patch specifically escapes line terminators and '@' characters so attacker text can no longer break out of a '//' comment to inject executable code or forge '// @require dbgate-plugin-evil' / '// @schedule' directives. Successful breakout yields arbitrary JS execution as the DbGate API process (effectively RCE), which realistically warrants HIGH confidentiality/integrity/availability - so I assess ~8.8 (3.1) rather than 5.3, while noting VulDB likely scored impact low because DbGate's runner executes user scripts by design and this is partly a lower-privilege path to that capability. On exploitation signals: no CISA KEV listing, no EPSS score provided, and no public exploit code is referenced (only VulDB entries and vendor patch links) - so there is no evidence of active exploitation. Net: a genuine authenticated code-execution issue in a niche product; not a widespread emergency, but priority for any environment running DbGate with multiple/untrusted users. The disagreement between the raw 5.3 score and the RCE-class mechanism should be verified against the vendor advisory (GHSA-rfx7-cmmf-7ff7 referenced in the patch).

An authenticated low-privilege DbGate user supplies crafted comment text or a schedule value containing a line terminator (e.g. \n or U+2028) followed by JavaScript, or an '@require'/'@schedule' directive substring. When DbGate's ScriptWriter generates the runner script and the API executes it, the injected content breaks out of the '//' comment line and runs as code - or loads an attacker-named plugin - executing on the DbGate server. No public proof-of-concept is referenced at time of analysis.