Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a classic code injection flaw in the DbGate API. The root cause is the lack of input validation on the functionName parameter of the /runners/load-reader endpoint. This user-controlled input is directly embedded into a dynamically generated JavaScript script on the server side.
The patch addresses this by introducing a new function, assertValidShellApiFunctionName, which strictly validates the functionName to ensure it is a valid JavaScript identifier, optionally with a plugin namespace. This validation is now performed at the beginning of the loaderScriptTemplate function, which is responsible for generating the script. By ensuring the functionName is a safe, well-formed string before it is used, the patch effectively closes the code injection vulnerability.
An attacker exploiting this vulnerability would send a specially crafted functionName to the /runners/load-reader endpoint. The profiler would show a call to the function handling this endpoint, which in turn calls loaderScriptTemplate. Therefore, loaderScriptTemplate is the key function to monitor for exploitation attempts.
loaderScriptTemplatepackages/api/src/controllers/runners.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| dbgate-api | npm | <= 7.1.8 | 7.1.9 |