CVEvulnerability
CVE-2024-21508
9.8 CRITICAL
Official page ↗
- Status
- Deferred
- Published
- 2024-04-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
Description
Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://blog.slonser.info/posts/mysql2-attacker-configuration/ blog.slonser.info
- https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21 github.com
- https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805 github.com
- https://github.com/sidorares/node-mysql2/pull/2572 github.com
- https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4 github.com
- https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085 security.snyk.io
- https://blog.slonser.info/posts/mysql2-attacker-configuration/ blog.slonser.info
- https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21 github.com
- https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805 github.com
- https://github.com/sidorares/node-mysql2/pull/2572 github.com
- https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4 github.com
- https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085 security.snyk.io