Mariadb Connector Nodejs
Monthly
SQL injection in the MariaDB Connector/Node.js driver (CWE-89) allows unauthenticated remote attackers to break out of string literals and execute arbitrary SQL with the application's database privileges when the session runs with NO_BACKSLASH_ESCAPES enabled. The flaw affects all releases prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4: the connector's text-protocol escaper, including Connection.escape(), always prefixes quotes with a backslash and ignores the session's NO_BACKSLASH_ESCAPES mode, in which the backslash is an ordinary character and cannot escape the quote. Exploitation is conditional rather than drive-by: it requires NO_BACKSLASH_ESCAPES to be active (server-wide, set through connector initialization options, or via an application-issued SET sql_mode - not the default MariaDB/MySQL behavior), requires attacker-controlled values to reach query() or Connection.escape() text protocol handling, and does not apply to execute() or batch(), which use binary protocols. Vendor-released patch: 3.2.5, 3.3.4, 3.4.7, 3.5.4; no public exploit identified at time of analysis (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N), though a HackerOne report and public commits document the defect.
SQL injection in MariaDB Connector/Node.js (3.2.0 through 3.2.4, 3.3.x before 3.3.4, 3.4.x before 3.4.7, and 3.5.x before 3.5.4) allows an attacker-influenced object key containing a backtick to break out of the quoted identifier the driver builds when it expands object properties into a SQL SET clause, letting the remainder of the key be parsed as SQL so that columns the application never intended to expose can be updated or arbitrary statements appended with the database user's privileges. Exploitation is conditional and unauthenticated at the driver layer (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): the application must explicitly enable the non-default permitSetMultiParamEntries option and must pass object KEYS - not merely values - derived from attacker-influenced input into an expanded `SET ?` clause. No public exploit code or confirmed active exploitation was identified at time of analysis, and the limiting factors (off-by-default feature plus the need for attacker-controlled keys) are the reason the assessed vector carries AC:H; the serialized-object handling used when the option is disabled is not affected.
Malformed GeoJSON Polygon or MultiPolygon values cause MariaDB Connector/Node.js - every release before 3.2.5, 3.3.4, 3.4.7 and 3.5.4 - to write uninitialized Node.js heap memory into database values. When a calling application passes a non-array 'ring' (an object exposing a numeric length, a string, or a number) through the binary-protocol execute() or batch() APIs, the encoder sizes a Buffer.allocUnsafe() allocation from that ring's length but the writing loop skips the reserved bytes, so the entire buffer is sent and persisted in the database, potentially carrying other users' content, session material, database credentials or TLS key material that can then spread to backups and replicas. The published CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) treats this as a trivially reachable unauthenticated disclosure, but independent review rates attack complexity High because exploitation additionally requires the attacker to influence the geometry value the application passes to the connector, the application to actually use binary-protocol prepared statements or batches with geometry rather than the unaffected text-protocol query() path, and the ability to read the persisted value back; no public exploit code has been identified at time of analysis and there is no CISA KEV entry.
Denial of service in MariaDB Connector/Node.js versions 3.3.0 through 3.5.3 occurs when a Node.js application connects over TCP to a MariaDB or MySQL server with TLS enabled in the zero-configuration mode (ssl: true, or an ssl object whose rejectUnauthorized is not false, and no ssl.ca supplied) while client_ed25519 is negotiated as the authentication plugin and a password is configured. Under those conditions, any server or network attacker presenting a self-signed certificate drives the connector into a code path that throws an uncaught ReferenceError from the socket data handler; because Node.js terminates the process on an uncaught exception by default, the client application crashes, resulting in a remote denial of service. The issue is rated moderate (CVSS 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the requirement for a specific combination of TLS, CA, and authentication-plugin settings places meaningful constraints on exploitability, and the vendor-released patch is version 3.5.4.
SQL injection in MariaDB Connector/Node.js exposes applications to data exfiltration or modification when using non-default multi-byte character sets (big5, gbk, sjis, cp932, or gb18030) with attacker-controlled Buffer query parameters. Versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a charset-unaware byte-wise escape routine that allows an attacker-supplied lead byte to absorb the connector-inserted backslash (0x5C) as a multi-byte trail byte, leaving the following quote (0x27) unescaped and terminating the SQL string literal. No public exploit code has been identified at time of analysis and this CVE is not in the CISA KEV catalog, but the root technique is well-documented in public security literature as the classic GBK/Big5 multi-byte escape bypass.
PAM dialog authentication in MariaDB Connector/Node.js discloses account passwords in cleartext when connections use plain TCP, because the SendPamAuthPacketFactory handler omitted the secure-transport gate that was already applied to the sibling mysql_clear_password plugin. Applications connecting to MariaDB with default settings (sslMode=DISABLE, restrictedAuth=null) over untrusted network paths are exposed to credential theft by any on-path attacker or rogue server that issues an Authentication Switch Request for the dialog plugin. No active exploitation or public exploit code has been identified; vendor-released patches are available across all active 3.x branches.
SQL injection in the MariaDB Connector/Node.js driver (CWE-89) allows unauthenticated remote attackers to break out of string literals and execute arbitrary SQL with the application's database privileges when the session runs with NO_BACKSLASH_ESCAPES enabled. The flaw affects all releases prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4: the connector's text-protocol escaper, including Connection.escape(), always prefixes quotes with a backslash and ignores the session's NO_BACKSLASH_ESCAPES mode, in which the backslash is an ordinary character and cannot escape the quote. Exploitation is conditional rather than drive-by: it requires NO_BACKSLASH_ESCAPES to be active (server-wide, set through connector initialization options, or via an application-issued SET sql_mode - not the default MariaDB/MySQL behavior), requires attacker-controlled values to reach query() or Connection.escape() text protocol handling, and does not apply to execute() or batch(), which use binary protocols. Vendor-released patch: 3.2.5, 3.3.4, 3.4.7, 3.5.4; no public exploit identified at time of analysis (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N), though a HackerOne report and public commits document the defect.
SQL injection in MariaDB Connector/Node.js (3.2.0 through 3.2.4, 3.3.x before 3.3.4, 3.4.x before 3.4.7, and 3.5.x before 3.5.4) allows an attacker-influenced object key containing a backtick to break out of the quoted identifier the driver builds when it expands object properties into a SQL SET clause, letting the remainder of the key be parsed as SQL so that columns the application never intended to expose can be updated or arbitrary statements appended with the database user's privileges. Exploitation is conditional and unauthenticated at the driver layer (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): the application must explicitly enable the non-default permitSetMultiParamEntries option and must pass object KEYS - not merely values - derived from attacker-influenced input into an expanded `SET ?` clause. No public exploit code or confirmed active exploitation was identified at time of analysis, and the limiting factors (off-by-default feature plus the need for attacker-controlled keys) are the reason the assessed vector carries AC:H; the serialized-object handling used when the option is disabled is not affected.
Malformed GeoJSON Polygon or MultiPolygon values cause MariaDB Connector/Node.js - every release before 3.2.5, 3.3.4, 3.4.7 and 3.5.4 - to write uninitialized Node.js heap memory into database values. When a calling application passes a non-array 'ring' (an object exposing a numeric length, a string, or a number) through the binary-protocol execute() or batch() APIs, the encoder sizes a Buffer.allocUnsafe() allocation from that ring's length but the writing loop skips the reserved bytes, so the entire buffer is sent and persisted in the database, potentially carrying other users' content, session material, database credentials or TLS key material that can then spread to backups and replicas. The published CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) treats this as a trivially reachable unauthenticated disclosure, but independent review rates attack complexity High because exploitation additionally requires the attacker to influence the geometry value the application passes to the connector, the application to actually use binary-protocol prepared statements or batches with geometry rather than the unaffected text-protocol query() path, and the ability to read the persisted value back; no public exploit code has been identified at time of analysis and there is no CISA KEV entry.
Denial of service in MariaDB Connector/Node.js versions 3.3.0 through 3.5.3 occurs when a Node.js application connects over TCP to a MariaDB or MySQL server with TLS enabled in the zero-configuration mode (ssl: true, or an ssl object whose rejectUnauthorized is not false, and no ssl.ca supplied) while client_ed25519 is negotiated as the authentication plugin and a password is configured. Under those conditions, any server or network attacker presenting a self-signed certificate drives the connector into a code path that throws an uncaught ReferenceError from the socket data handler; because Node.js terminates the process on an uncaught exception by default, the client application crashes, resulting in a remote denial of service. The issue is rated moderate (CVSS 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the requirement for a specific combination of TLS, CA, and authentication-plugin settings places meaningful constraints on exploitability, and the vendor-released patch is version 3.5.4.
SQL injection in MariaDB Connector/Node.js exposes applications to data exfiltration or modification when using non-default multi-byte character sets (big5, gbk, sjis, cp932, or gb18030) with attacker-controlled Buffer query parameters. Versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a charset-unaware byte-wise escape routine that allows an attacker-supplied lead byte to absorb the connector-inserted backslash (0x5C) as a multi-byte trail byte, leaving the following quote (0x27) unescaped and terminating the SQL string literal. No public exploit code has been identified at time of analysis and this CVE is not in the CISA KEV catalog, but the root technique is well-documented in public security literature as the classic GBK/Big5 multi-byte escape bypass.
PAM dialog authentication in MariaDB Connector/Node.js discloses account passwords in cleartext when connections use plain TCP, because the SendPamAuthPacketFactory handler omitted the secure-transport gate that was already applied to the sibling mysql_clear_password plugin. Applications connecting to MariaDB with default settings (sslMode=DISABLE, restrictedAuth=null) over untrusted network paths are exposed to credential theft by any on-path attacker or rogue server that issues an Authentication Switch Request for the dialog plugin. No active exploitation or public exploit code has been identified; vendor-released patches are available across all active 3.x branches.