CVE-2026-107384

Description

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

References

https://jira.mariadb.org/browse/CONJS-369

https://hackerone.com/reports/3889198

https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-v6pj-gxxw-phfw

https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4

https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7

https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4

https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5

https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b9b04ec82a60b2caf2b0c038259ca9aff5d7014a

https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/8eb450972ff0f3826d7d45c071a42240798bc826

https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6743b2f4a89b074268b44c650170767f35e1fb5d

https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/144b8f4ef29539a9fb4b75d972b9dcdac4088b4e

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3