critical9.8
CVE-2024-21511
MySQL2 for Node Arbitrary Code Injection
Impact
Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | mysql2 | < 3.9.7 | 3.9.7 |
Affected products
| Product | Affected versions |
|---|---|
| Package Mysql2 | before 3.9.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713
- https://github.com/sidorares/node-mysql2/pull/2608
- https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7
- https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046
- https://github.com/advisories/GHSA-4rch-2fh8-94vw
- https://nvd.nist.gov/vuln/detail/CVE-2024-21511