DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.

Affected: npm: dbgate-serve

### Summary DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process.

### Details #### Step 1: User Input Entry Point

**File:** `packages/api/src/controllers/runners.js` - `start()` method

The `/runners/start` endpoint accepts a POST body containing a `script` object. When `script.type == 'json'`, the request follows a different code path than raw shell scripts:

```javascript async start({ script }, req) { if (script.type == 'json') { if (!platformInfo.isElectron) { if (!checkSecureDirectoriesInScript(script)) { return { errorMessage: 'Unallowed directories in script' }; } } logJsonRunnerScript(req, script); const js = await jsonScriptToJavascript(script); return this.startCore(runid, scriptTemplate(js, false)); } ``` This path skips: 1. The `run-shell-script` permission check 2. The `allowShellScripting` platform-level check

The only validation performed is `checkSecureDirectoriesInScript()`, which `props.fileName` values

---

#### Step 2: JSON-to-JavaScript Conversion (Injection Point)

**File:** `packages/tools/src/ScriptWriter.ts` - `assignCore()` method

The JSON script's `comma…