CVE-2024-21508

critical

Description

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

References

https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085

https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4

https://github.com/sidorares/node-mysql2/pull/2572

https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805

https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21

https://blog.slonser.info/posts/mysql2-attacker-configuration/

Details

Source: Mitre, NVD

Published: 2024-04-11

Updated: 2026-04-15

Risk Information

CVSS v2

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: Critical

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H