Is CVE-2026-97225 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97225 being exploited in the wild.

How severe is CVE-2026-97225?

Medium severity, with a CVSS score of 6.3, published 24 September 2026.

Is there a fix for CVE-2026-97225?

A patch was published on 2026-09-24: version 7.2.5-beta.6 and commit 70e7b6b58e464d7a015ba16e8d7574b420ee4877 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97225 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-97225?

Check whether you run DbGate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97225: DbGate code injection in JSON Runner comment handling

CVE-2026-97225 · Severity: medium · CVSS 6.3 · Published 2026-09-24

DbGate is a database management tool that supports MySQL, PostgreSQL, SQL Server, MongoDB, and SQLite across multiple platforms. A code injection vulnerability in the JSON Runner component allows attackers to execute arbitrary code by manipulating comment and schedule parameters in API requests. This could lead to remote code execution on systems running vulnerable versions of DbGate.

Technologies: DbGate. Vendors: DbGate.

Quick answers

Is CVE-2026-97225 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97225 being exploited in the wild.
How severe is CVE-2026-97225?: Medium severity, with a CVSS score of 6.3, published 24 September 2026.
Which products and versions are affected?: DbGate up to 7.2.5-beta.5.
Is there a fix for CVE-2026-97225?: A patch was published on 2026-09-24: version 7.2.5-beta.6 and commit 70e7b6b58e464d7a015ba16e8d7574b420ee4877 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97225 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-97225?: Check whether you run DbGate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in packages/api/src/controllers/runners.js where the comment.text and script.schedule parameters are not properly sanitized before use in the JSON Runner component. An unauthenticated remote attacker can inject code through line terminators or other special characters in these fields to achieve code execution. The vulnerability affects DbGate up to version 7.2.5-beta.5 and is patched in 7.2.5-beta.6.

Affected products

dbgate DbGate up to 7.2.5-beta.5

Timeline

2026-09-24: disclosed
2026-09-24: patched: version 7.2.5-beta.6 and commit 70e7b6b58e464d7a015ba16e8d7574b420ee4877

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.