Submit #908099: DbGate DbGate / dbgate-serve <= 7.2.4-packer-beta.3 Code Injection

Authenticated remote code execution in DbGate / dbgate-serve through newline injection in JSON runner line-comment metadata.

DbGate / dbgate-serve up to 7.2.4-packer-beta.3 is affected by an authenticated code injection vulnerability in the JSON script runner. The issue is reachable through the following authenticated endpoints:

POST /runners/start
POST /runners/script-result

Affected code paths:

packages/api/src/controllers/runners.js
packages/tools/src/ScriptWriter.ts

The root cause is improper neutralization of newline characters in attacker-controlled JSON runner metadata fields before JavaScript code generation. In the JSON runner code generation path, comment.text is emitted into the generated JavaScript as a single-line comment. The script.schedule value is also emitted as single-line JavaScript metadata.

Because newline characters are not escaped, rejected, or encoded, an authenticated user can inject a newline into comment.text or script.schedule, break out of the generated JavaScript comment context, and cause the following line to be interpreted as executable JavaScript by the runner process.

This turns structured JSON runner metadata into executable JavaScript. The vulnerable values are metadata fields, not explicit JavaScript script bodies, so this should not be considered intended script execution.

The generated JavaScript is later executed by the runner flow. In /runners/start, the JSON runner input is converted to JavaScript and passed to the runner execution path. In /runners/script-result, the same JSON-to-JavaScript generation path is reachable and the command result can be returned through the runner dataResult flow.

The issue was reproduced in a local Docker deployment built from DbGate master / 7.2.4-packer-beta.3. The test user was authenticated but configured without the run-shell-script permission. Despite that restriction, injected JavaScript executed inside the DbGate runner process and was able to access Node.js APIs, resulting in operating system command execution. In the tested Docker deployment, the command executed as root inside the DbGate container.

Impact:

An authenticated attacker with access to the JSON runner endpoint can execute arbitrary operating system commands with the privileges of the DbGate runner process. Depending on the deployment, this may allow reading or modifying files accessible to the DbGate process, accessing saved database connection material, credentials, secrets, or mounted volumes, deleting writable files, causing denial of service, or further compromise depending on container isolation and runtime configuration.

This issue is distinct from previous DbGate JSON runner RCE issues involving functionName interpolation. The vulnerable sinks in this report are comment.text and script.schedule, which are emitted into generated JavaScript single-line comments without proper newline handling.

Suggested vulnerability class:

Code Injection / Improper Control of Generation of Code

Suggested CWE:

Primary: CWE-94 - Improper Control of Generation of Code
Related: CWE-116 - Improper Encoding or Escaping of Output
Related: CWE-20 - Improper Input Validation

Suggested CVSS v3.1:

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High

Vendor contact:

The vendor was contacted through GitHub Security Advisory on July 25, 2026. No vendor response, CVE assignment, or patched version is known at the time of this submission. No CVE is known to be assigned for this specific comment.text / script.schedule newline injection issue.

• User: ZsZsec (UID 100174)
• Submission: 07/28/2026 21:59 (2 months ago)
• Moderation: 09/24/2026 11:53 (2 months later)
• Status: Accepted
• VulDB entry: 409319 [DbGate up to 7.2.5-beta.5 JSON Runner runners.js comment.text/script.schedule code injection]
• Points: 17