EUVD-2026-95143
GHSA-v6pj-gxxw-phfw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach app endpoint mapping user input to object keys
-
DeliveryCraft key with embedded backtick and SQL
-
ExploitBacktick closes quoted identifier in SET clause
-
ExecutionAppended SQL executed with DB user privileges
-
ImpactOverwrite unintended columns / run arbitrary SQL
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires three concrete conditions: (1) the application must explicitly enable the non-default permitSetMultiParamEntries connection option (it is disabled by default, and the serialized-object handling used when disabled is not affected); (2) the application must expand an object into a SQL SET clause (e.g. query('UPDATE ... SET ?', [obj])) where the object's KEYS - not just values - derive from attacker-influenced input; and (3) the attacker must be able to place a backtick within a key. Affected versions are 3.2.0 up to but not including 3.2.5, 3.3.4, 3.4.7, and 3.5.4. The limiting factors (off-by-default feature plus the need for attacker-controlled object keys, not merely values) are why AC is High; absent these, default configurations and value-only user input are not exploitable. |
| Impact | This is a genuine high-severity SQL injection (CWE-89) but a conditional one, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1) correctly reflects both the serious impact (full C/I/A at the database-user privilege level) and the elevated attack complexity (AC:H), which maps directly to the hard precondition that the non-default permitSetMultiParamEntries option be enabled. No EPSS score, no CISA KEV listing, and no vendor claim of active exploitation are present in the input, so there is no evidence of in-the-wild abuse; the most concrete exploitation signal is the HackerOne report (3889198) and the detailed integration/unit tests in the fix commits, which publish a working malicious key payload. The AC:H plus an off-by-default feature means this is a real priority only for the subset of deployments that have opted into permitSetMultiParamEntries AND pass attacker-influenced object keys into a SET clause - for everyone else the practical risk is low. Net: a well-understood, vendor-fixed injection with public exploit detail but no confirmed mass exploitation; treat as high-priority patching for affected Node.js apps using that option, routine otherwise. |
| Exploit ScenarioDerived | A Node.js application built on MariaDB Connector/Node.js enables permitSetMultiParamEntries and builds an UPDATE/INSERT by passing a user-influenced object into a SET clause (e.g. conn.query('UPDATE t SET ? WHERE id=?', [userObject, id])). An attacker supplies an object key such as "secret |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
SQL injection in MariaDB Connector/Node.js (3.2.0 through 3.2.4, 3.3.x before 3.3.4, 3.4.x before 3.4.7, and 3.5.x before 3.5.4) allows an attacker-influenced object key containing a backtick to break out of the quoted identifier the driver builds when it expands object properties into a SQL SET clause, letting the remainder of the key be parsed as SQL so that columns the application never intended to expose can be updated or arbitrary statements appended with the database user's privileges. Exploitation is conditional and unauthenticated at the driver layer (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): the application must explicitly enable the non-default permitSetMultiParamEntries option and must pass object KEYS - not merely values - derived from attacker-influenced input into an expanded SET ? clause. No public exploit code or confirmed active exploitation was identified at time of analysis, and the limiting factors (off-by-default feature plus the need for attacker-controlled keys) are the reason the assessed vector carries AC:H; the serialized-object handling used when the option is disabled is not affected.
RemediationAI
Vendor-released patch: upgrade MariaDB Connector/Node.js to 3.2.5, 3.3.4, 3.4.7, or 3.5.4 (or any later release on the same line) as published at the tagged release pages https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5, /3.3.4, /3.4.7 and /3.5.4; the fix is carried by commits 144b8f4ef29539a9fb4b75d972b9dcdac4088b4e, 6743b2f4a89b074268b44c650170767f35e1fb5d, 8eb450972ff0f3826d7d45c071a42240798bc826 and b9b04ec82a60b2caf2b0c038259ca9aff5d7014a per advisory GHSA-v6pj-gxxw-phfw and Jira CONJS-369. If upgrading immediately is not possible, the most effective compensating control is to leave permitSetMultiParamEntries at its default of false and build SET clauses explicitly with named, hard-coded column identifiers (e.g. 'UPDATE t SET a = ?, b = ?' with bound values) - the trade-off is that the convenience of passing an object as a single parameter is lost and callers must enumerate columns, and any code that currently relies on the option will need those queries rewritten. For deployments that must keep the option enabled, treat every object key as untrusted: enforce a server-side allowlist of permitted column names and reject keys containing backticks or other SQL metacharacters before they reach the driver, since key values (not just data values) must be fully attacker-agnostic; this preserves multi-parameter expansion but adds a validation layer that must be applied on every query path, including nested objects and the escapeParameters recursion. Monitoring database error logs for ER_BAD_FIELD_ERROR on UPDATE/INSERT statements whose SET list was built from an object is a useful detection signal for attempted exploitation, and no additional mitigation is needed for the serialized-object path used when the option is disabled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89 (improper neutralization of special elements used in SQL), specifically identifier-context injection rather than classic value-context injection. MariaDB Connector/Node.js is the Node.js client driver for MariaDB and MySQL; when the connection option permitSetMultiParamEntries is enabled, passing a plain object as a query parameter (for example conn.query('UPDATE t SET ? WHERE id = ?', [obj, id])) causes each object KEY to be emitted as a column name in the generated SET list. Before the fix, those keys were wrapped in backticks by naive string concatenation ('' + key + '') in lib/cmd/encoder/text-encoder.js, lib/cmd/query.js, and lib/misc/utils.js, so an embedded backtick could terminate the quoted identifier and leave the rest of the key to be interpreted as SQL. The upstream remediation introduces TextEncoder.escapeId(), which doubles any backtick in the key (and always quotes, preserving the ability to reference reserved words such as order), and routes the SET-clause key emission in the text encoder, the query encoder, and the recursive escapeParameters helper through it. An escapeId consistency test confirms the new helper matches the public utils.escapeId() output for inputs including 'ab', 'plain', '' and the injection payload "secret = 'PWNED', `name"; integration regression tests confirm a backtick-bearing key now produces an ER_BAD_FIELD_ERROR (the whole key becomes one identifier) instead of writing an unintended column, while ordinary keys and reserved-word keys continue to expand normally. The affected CPE is cpe:2.3:a:mariadb-corporation:mariadb-connector-nodejs, and upstream tracking is GHSA-v6pj-gxxw-phfw and Jira CONJS-369.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H because the non-default permitSetMultiParamEntries option and attacker-controlled object keys are required; PR:N since no connector auth is needed; C/I/A:H as arbitrary SQL runs at the DB user's privilege.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Technical POC Analysis
Advisory: GHSA-v6pj-gxxw-phfw.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
MariaDB Connector/Node.js versions 3.2.0 through 3.2.4, 3.3.x before 3.3.4, 3.4.x before 3.4.7, and 3.5.x before 3.5.4 contain a high-severity SQL injection flaw (CVE-2026-107384) that can let an attacker manipulate database queries executed with the application's database user privileges. Exploitation is unauthenticated at the driver layer but conditional: the application must enable the non-default permitSetMultiParamEntries option and pass attacker-influenced object keys into an expanded SET ? clause, which limits exposure but still threatens data integrity and confidentiality where those patterns exist. Leadership should care because affected Node.js services could suffer unauthorized column updates or arbitrary SQL execution against connected MariaDB databases, and no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: disable the non-default permitSetMultiParamEntries option; avoid passing attacker-influenced object keys into expanded SET ? clauses; use parameterized queries and strict column-name allow-lists; run database accounts with least privilege; and monitor for anomalous SQL updates or appended statements.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB