medium6.5
CVE-2024-21509
mysql2 vulnerable to Prototype Poisoning
Impact
Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through `parserFn` in `text_parser.js` and `binary_parser.js`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | mysql2 | < 3.9.4 | 3.9.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sidorares | Mysql2 | before 3.9.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://blog.slonser.info/posts/mysql2-attacker-configuration/
- https://github.com/sidorares/node-mysql2/blob/fd3d117da82cc5c5fa5a3701d7b33ca77691bc61/lib/parsers/text_parser.js%23L134
- https://github.com/sidorares/node-mysql2/commit/4a964a3910a4b8de008696c554ab1b492e9b4691
- https://github.com/sidorares/node-mysql2/pull/2574
- https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
- https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591084
- https://github.com/advisories/GHSA-49j4-86m8-q2jw
- https://nvd.nist.gov/vuln/detail/CVE-2024-21509
- https://blog.slonser.info/posts/mysql2-attacker-configuration