MariaDB Connector/Node.js CVE-2026-55855
MEDIUM
GHSA-g5xc-5w98-jfvm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
AC:H because exploitation requires non-default charset configuration; PR:N because the attacker influences query contents through application input without needing credentials; no availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 4 npm packages depend on mariadb (3 direct, 1 indirect)
Ecosystem-wide dependent count for version 3.3.0.
DescriptionCVE.org
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 client character sets. PacketOutputStream.writeBufferEscape in lib/io/packet-output-stream.js escaped bytes without the charset-aware getMbRecognizer logic in lib/misc/charset-mb.js. The server SQL lexer runs my_ismbchar before escape processing, so an attacker-controlled lead byte can consume the inserted 0x5C backslash as a multibyte trail byte and leave the following 0x27 quote unescaped, terminating the string literal and allowing arbitrary SQL. The default utf8mb4 character set and parameters sent through the execute binary prepared-statement path are not affected. Successful exploitation can expose or modify data available to the database account. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
AnalysisAI
SQL injection in MariaDB Connector/Node.js exposes applications to data exfiltration or modification when using non-default multi-byte character sets (big5, gbk, sjis, cp932, or gb18030) with attacker-controlled Buffer query parameters. Versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a charset-unaware byte-wise escape routine that allows an attacker-supplied lead byte to absorb the connector-inserted backslash (0x5C) as a multi-byte trail byte, leaving the following quote (0x27) unescaped and terminating the SQL string literal. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all three conditions to hold simultaneously: (1) the mariadb npm package version is below the patched threshold for the installed 3.x branch (below 3.2.4, 3.3.3, 3.4.6, or 3.5.3); (2) the database connection's character_set_client is explicitly set to one of big5, gbk, sjis, cp932, or gb18030 - these are non-default configurations that must be deliberately chosen by the application developer, typically for East Asian locale support; and (3) attacker-controlled data reaches a Buffer-typed query parameter on the client-side text escape path (i.e., via the query() API with parameter interpolation, not the execute() binary prepared-statement API). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N reflects the network-reachable nature of the injection while correctly marking AC:H due to the non-default character set prerequisite, which materially narrows the exploitable population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade the mariadb npm package to a patched release: 3.2.4, 3.3.3, 3.4.6, or 3.5.3, available at the respective GitHub release tags (e.g., https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today