CVE-2024-21512

high

Description

Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.

References

https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580

https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010

https://github.com/sidorares/node-mysql2/pull/2702

https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc

https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a

Details

Source: Mitre, NVD

Published: 2024-05-29

Updated: 2026-04-15

Risk Information

CVSS v2

Base Score: 8.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:P

Severity: High

CVSS v3

Base Score: 8.2

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L