GHSA-4rch-2fh8-94vw

MySQL2 for Node Arbitrary Code Injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-21511

Packages

Ecosystem	Package	Affected	Fixed in
npm	mysql2	< 3.9.7	3.9.7

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-21511 advisory
https://github.com/sidorares/node-mysql2/pull/2608 web
https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713 web
https://github.com/sidorares/node-mysql2 package
https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7 web
https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046 web