{"id":"CVE-2026-97225","published":"2026-09-24T16:17:28.880","lastModified":"2026-09-25T15:17:57.237","description":"A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from remote. Upgrading to version 7.2.5-beta.6 mitigates this issue. This patch is called 70e7b6b58e464d7a015ba16e8d7574b420ee4877. Upgrading the affected component is advised. This issue is distinct from CVE-2026-47668.","cvssScore":6.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cwes":["CWE-74","CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/dbgate/dbgate/","tags":[]},{"url":"https://github.com/dbgate/dbgate/commit/70e7b6b58e464d7a015ba16e8d7574b420ee4877","tags":[]},{"url":"https://github.com/dbgate/dbgate/pull/1527","tags":[]},{"url":"https://github.com/dbgate/dbgate/releases/tag/v7.2.5-beta.6","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-97225","tags":[]},{"url":"https://vuldb.com/submit/908099","tags":[]},{"url":"https://vuldb.com/vuln/409319","tags":[]},{"url":"https://vuldb.com/vuln/409319/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/dbgate/dbgate/","tags":[]},{"url":"https://github.com/dbgate/dbgate/commit/70e7b6b58e464d7a015ba16e8d7574b420ee4877","tags":[]},{"url":"https://github.com/dbgate/dbgate/pull/1527","tags":[]},{"url":"https://github.com/dbgate/dbgate/releases/tag/v7.2.5-beta.6","tags":[]}],"hasPoc":true,"ai":null}