GHSA-pmh2-wpjm-fj45

mysql2 vulnerable to Prototype Pollution

Source: GitHub Advisory Database (reviewed) High CVE-2024-21512

Packages

Ecosystem	Package	Affected	Fixed in
npm	mysql2	< 3.9.8	3.9.8

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-21512 advisory
https://github.com/sidorares/node-mysql2/pull/2702 web
https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc web
https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a web
https://github.com/sidorares/node-mysql2 package
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010 web
https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580 web