GHSA-49j4-86m8-q2jw

mysql2 vulnerable to Prototype Poisoning

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-21509

Packages

Ecosystem	Package	Affected	Fixed in
npm	mysql2	< 3.9.4	3.9.4

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through `parserFn` in `text_parser.js` and `binary_parser.js`.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-21509 advisory
https://github.com/sidorares/node-mysql2/pull/2574 web
https://github.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691 web
https://blog.slonser.info/posts/mysql2-attacker-configuration web
https://github.com/sidorares/node-mysql2 package
https://github.com/sidorares/node-mysql2/blob/fd3d117da82cc5c5fa5a3701d7b33ca77691bc61/lib/parsers/text_parser.js%23L134 web
https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4 web
https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591084 web