Log in Start free

Vulnerability · Published Oct 8, 2026 · Assigned by GitHub_M

CVE-2026-107384MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

High 8.1

In plain English

A high-severity SQL injection in mariadb-connector-nodejs from mariadb-corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 60.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmmariadb3.2.5GHSA-v6pj-gxxw-phfw
npmmariadb3.3.4GHSA-v6pj-gxxw-phfw
npmmariadb3.4.7GHSA-v6pj-gxxw-phfw
npmmariadb3.5.4GHSA-v6pj-gxxw-phfw

Affected products (as reported)

VendorProductVersions
mariadb-corporation mariadb-connector-nodejs >= 3.2.0, < 3.2.5>= 3.3.0, < 3.3.4>= 3.4.0, < 3.4.7>= 3.5.0-rc.0, < 3.5.4

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References