MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL
    databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable
    permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being
    processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier
    and cause the remainder of the key to be interpreted as SQL. This can update columns the application did
    not intend to expose and can append arbitrary SQL with the database user's privileges. The option is
    disabled by default, and serialized-object handling used when it is disabled is not affected. This issue
    is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4. (CVE-2026-107384)

ID	Name	Product	Family	Type	Severity
474364	Chainguard: multiple sqlpad packages: security update to 7.5.7-r49	Tenable Cloud Security	Chainguard Local Security Checks	Local	high
474364	Chainguard: multiple sqlpad packages: security update to 7.5.7-r49	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	high
473981	SCA: security update for mariadb (GHSA-v6pj-gxxw-phfw)	Tenable Cloud Security	SCA Checks	Local	high
473981	SCA: security update for mariadb (GHSA-v6pj-gxxw-phfw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-107384

high

Tenable Plugins

high

high

high

high