Open-source package vulnerability · npm
CVE-2024-21511: MySQL2 for Node Arbitrary Code Injection
criticalCVSS 3.1 9.8GHSA-4rch-2fh8-94vw
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
Published Apr 23, 2024
Affected packages
mysql2
- Ecosystem
- npm
- Affected
- < 3.9.7
- Fixed in
- 3.9.7
- Check
npm ls mysql2
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-21511
- https://github.com/sidorares/node-mysql2/pull/2608
- https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713
- https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7
- https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046
- https://github.com/advisories/GHSA-4rch-2fh8-94vw
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology