high8.2
CVE-2024-21512
mysql2 vulnerable to Prototype Pollution
Impact
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | mysql2 | < 3.9.8 | 3.9.8 |
Affected products
| Product | Affected versions |
|---|---|
| Package Mysql2 | before 3.9.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
- https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
- https://github.com/sidorares/node-mysql2/pull/2702
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
- https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
- https://github.com/advisories/GHSA-pmh2-wpjm-fj45
- https://nvd.nist.gov/vuln/detail/CVE-2024-21512