# CVE-2026-97225: DbGate code injection in JSON Runner comment handling

Source: https://junglewise.ai/threats/cve-2026-97225-a-flaw-has-been-found-in-dbgate-up-to-7-2-5-beta-5-this-affects  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-97225 · Severity: medium · CVSS 6.3 · Published 2026-09-24

DbGate is a database management tool that supports MySQL, PostgreSQL, SQL Server, MongoDB, and SQLite across multiple platforms. A code injection vulnerability in the JSON Runner component allows attackers to execute arbitrary code by manipulating comment and schedule parameters in API requests. This could lead to remote code execution on systems running vulnerable versions of DbGate.

Technologies: [DbGate](https://junglewise.ai/threats/technologies/dbgate). Vendors: [DbGate](https://junglewise.ai/threats/vendors/dbgate).

## Quick answers

**Is CVE-2026-97225 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97225 being exploited in the wild.

**How severe is CVE-2026-97225?** Medium severity, with a CVSS score of 6.3, published 24 September 2026.

**Which products and versions are affected?** DbGate up to 7.2.5-beta.5.

**Is there a fix for CVE-2026-97225?** A patch was published on 2026-09-24: version 7.2.5-beta.6 and commit 70e7b6b58e464d7a015ba16e8d7574b420ee4877 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97225 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97225?** Check whether you run DbGate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in packages/api/src/controllers/runners.js where the comment.text and script.schedule parameters are not properly sanitized before use in the JSON Runner component. An unauthenticated remote attacker can inject code through line terminators or other special characters in these fields to achieve code execution. The vulnerability affects DbGate up to version 7.2.5-beta.5 and is patched in 7.2.5-beta.6.

## Affected products

- dbgate DbGate up to 7.2.5-beta.5

## Timeline

- 2026-09-24: disclosed
- 2026-09-24: patched: version 7.2.5-beta.6 and commit 70e7b6b58e464d7a015ba16e8d7574b420ee4877

## References

- [https://github.com/dbgate/dbgate/](https://github.com/dbgate/dbgate/)
- [https://github.com/dbgate/dbgate/commit/70e7b6b58e464d7a015ba16e8d7574b420ee4877](https://github.com/dbgate/dbgate/commit/70e7b6b58e464d7a015ba16e8d7574b420ee4877)

## Related threats

- [DbGate missing authorization in connection management](https://junglewise.ai/threats/cve-2026-121455-dbgate-before-7-3-3-contains-a-missing-authorization)
- [DbGate path traversal in Files Endpoint](https://junglewise.ai/threats/cve-2026-101070-a-security-vulnerability-has-been-detected-in-dbgate-up-to-7-3-1)
- [DbGate arbitrary file write via path traversal in exportModelSql](https://junglewise.ai/threats/cve-2026-101069-a-weakness-has-been-identified-in-dbgate-up-to-7-3-1-affected-is)
- [DbGate path traversal in Create Connection Endpoint](https://junglewise.ai/threats/cve-2026-101068-a-security-flaw-has-been-discovered-in-dbgate-up-to-7-3-1-this)
- [DbGate path traversal in save-uploaded-file endpoint](https://junglewise.ai/threats/cve-2026-101067-a-vulnerability-was-identified-in-dbgate-up-to-6-8-1-7-0-2-7-1-8)