EUVD-2026-95150
GHSA-r3rv-jm3r-62q2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach input bound to a query() placeholder
-
DeliverySubmit value containing a single quote
-
ExploitBackslash escaping fails under NO_BACKSLASH_ESCAPES
-
ExecutionQuote closes literal and injected SQL executes with app DB privileges
-
ImpactExfiltrate or tamper database data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the NO_BACKSLASH_ESCAPES SQL mode to be active - enabled server-wide, through the connector's initialization options, or via an application-issued SET sql_mode - which is NOT the default MariaDB/MySQL behavior. The application must also send the attacker-controlled value through the text protocol: query() or Connection.escape(). Key LIMITING factors: execute() and batch() use the binary protocol and are NOT vulnerable; the attacker must control a placeholder/parameter value that reaches text-protocol escaping; and the target must be running a pre-fix version (before 3.2.5, 3.3.4, 3.4.7, or 3.5.4). Where NO_BACKSLASH_ESCAPES is off (the common case), the flaw is not exploitable. |
| Impact | This is a genuine but conditional SQL injection (CWE-89) in the MariaDB Connector/Node.js driver, not a drive-by critical. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, 7.4) correctly captures that exploitation is network-reachable and pre-authentication from the connector's perspective, but carries high attack complexity (AC:H) because the flaw only triggers when the non-default NO_BACKSLASH_ESCAPES SQL mode is active AND the application uses the text protocol via query()/Connection.escape() rather than execute()/batch(). No EPSS score, CISA KEV listing, or public POC flag was supplied in the intelligence set, so by the available signals this is 'no public exploit identified at time of analysis' - though a HackerOne report (#3889197) and four fix commits indicate coordinated disclosure with a working private proof. One signal conflict worth flagging: the NVD vector assigns C:N (no confidentiality impact), yet the description states an attacker can 'inject arbitrary SQL,' which inherently permits reading data (SELECT) and therefore implies confidentiality impact - the C:N rating appears understated and should be verified against the vendor advisory. Net priority: patch promptly where NO_BACKSLASH_ESCAPES is in use, but the non-default-mode prerequisite meaningfully narrows the exposed population compared to the raw 7.4 score. |
| Exploit ScenarioDerived | An application runs MariaDB/MySQL with NO_BACKSLASH_ESCAPES enabled (server-wide, via connector options, or a prior SET sql_mode) and passes user-controlled input through query() or Connection.escape(). The attacker supplies a placeholder value containing a single quote; because the connector still escapes with a backslash that the server now treats as a literal character, the quote closes the SQL string and the attacker's appended SQL executes with the application's database privileges. No public exploit is identified at time of analysis, but a private HackerOne report and fix commits exist. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
SQL injection in the MariaDB Connector/Node.js driver (CWE-89) allows unauthenticated remote attackers to break out of string literals and execute arbitrary SQL with the application's database privileges when the session runs with NO_BACKSLASH_ESCAPES enabled. The flaw affects all releases prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4: the connector's text-protocol escaper, including Connection.escape(), always prefixes quotes with a backslash and ignores the session's NO_BACKSLASH_ESCAPES mode, in which the backslash is an ordinary character and cannot escape the quote. Exploitation is conditional rather than drive-by: it requires NO_BACKSLASH_ESCAPES to be active (server-wide, set through connector initialization options, or via an application-issued SET sql_mode - not the default MariaDB/MySQL behavior), requires attacker-controlled values to reach query() or Connection.escape() text protocol handling, and does not apply to execute() or batch(), which use binary protocols. Vendor-released patch: 3.2.5, 3.3.4, 3.4.7, 3.5.4; no public exploit identified at time of analysis (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N), though a HackerOne report and public commits document the defect.
RemediationAI
Vendor-released patch: upgrade the connector to the fixed build for your branch - 3.2.5 for 3.2.x, 3.3.4 for 3.3.x, 3.4.7 for 3.4.x, or 3.5.4 for 3.5.x (https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-r3rv-jm3r-62q2, https://jira.mariadb.org/browse/CONJS-368). If upgrading immediately is not possible, apply compensating controls that remove the prerequisite rather than generic hardening: (1) ensure NO_BACKSLASH_ESCAPES is never enabled - audit the server's global sql_mode, any connection-string/connector initialization options that set sql_mode, and application code that issues SET sql_mode, since without that flag the driver's backslash escaping is correct and the injection does not occur; the trade-off is that applications genuinely depending on NO_BACKSLASH_ESCAPES semantics must be refactored, and a server-wide sql_mode change affects all connected clients. (2) Migrate all parameterized data paths from query()/Connection.escape() to execute() or batch(), which use the binary protocol and were never affected - this is the most robust option but requires code review since it is per-call-site. (3) Stop passing untrusted input through client-side escaping entirely, use server-side prepared statements, and enforce least-privilege database accounts plus input validation/rejection of quote characters to reduce injection impact. Note that limiting exposure by restricting database privileges reduces the blast radius but does not fix the escaping defect; the connector upgrade remains the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability class is CWE-89 (SQL Injection) arising from incorrect context-aware escaping in a database client driver. MariaDB Connector/Node.js builds SQL text on the client side: when a parameter is sent over the text protocol, the driver escapes the value and wraps it in single quotes before transmitting the statement to the server. The escaping routine in lib/io/packet-output-stream.js and lib/misc/utils.js unconditionally emitted a backslash (0x5C) before quote, double-quote, backslash, NUL and control characters. In MySQL/MariaDB SQL, however, the server advertises the session flag STATUS_NO_BACKSLASH_ESCAPES (exposed in the server status bitfield returned in protocol packets). When NO_BACKSLASH_ESCAPES is present in sql_mode, backslash is an ordinary data character and the only way to escape a quote is to double it. The driver never checked that status flag, so the emitted backslash was interpreted as literal data and the following quote terminated the string literal, letting an attacker-controlled parameter inject arbitrary SQL. The upstream fix propagates the connection info/status into the escaping path, resolves an escape table (ESCAPE_BACKSLASH vs ESCAPE_DOUBLE_QUOTE) once per value, and switches the character-class regexp from /[\0"'\\\b\n\r\t\u001A]/ to /'/ so that quotes are doubled rather than backslashed when the mode is active; the commit note confirms parity with Connector/C and Connector/J behavior. CPE data identifies the affected component as cpe:2.3:a:mariadb-corporation:mariadb-connector-nodejs across all branches prior to the fixed releases.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Non-default NO_BACKSLASH_ESCAPES mode and text-protocol use make AC:H; no auth needed at the connector so PR:N; arbitrary SQL enables reads, so C:H (unlike NVD's C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that mode is enabled, the backslash is an ordinary character, so an attacker-controlled placeholder value can close the SQL string literal and inject arbitrary SQL with the application's database privileges. The vulnerable configuration may be enabled server-wide, through connector initialization options, or with an application-issued SET sql_mode; execute() and batch() use binary protocols and are not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Blast Radius
ecosystem impact- 4 npm packages depend on mariadb (3 direct, 1 indirect)
Ecosystem-wide dependent count for version 3.3.0.
Technical POC Analysis
Evidence caveat: the supplied material is the GitHub advisory (GHSA-r3rv-jm3r-62q2) only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The MariaDB Connector/Node.js database driver - the component Node.js applications use to talk to MariaDB and MySQL databases - contains a SQL injection flaw that can allow a remote attacker to execute arbitrary SQL under the application's own database privileges, potentially exposing, altering, or destroying any data that application account can reach. Exposure is conditional: it applies only where the non-default NO_BACKSLASH_ESCAPES SQL mode is active and attacker-controlled input reaches the driver's text-protocol query handling, so teams running this driver in Node.js services should treat it as an urgent dependency-remediation item rather than a broad internet-facing emergency.
Apply vendor patch: upgrade to 3.2.5, 3.3.4, 3.4.7, or 3.5.4 per vendor advisory. Until upgraded, ensure NO_BACKSLASH_ESCAPES is not enabled server-wide, in connector initialization options, or via SET sql_mode; route untrusted input through the execute()/batch() binary-protocol prepared statements instead of query() or Connection.escape(); and restrict the database privileges granted to the application account.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB