GitHub Advisoryadvisory · npm

GHSA-49j4-86m8-q2jw mysql2 vulnerable to Prototype Poisoning

MEDIUM Published 2024-04-10 Modified 2024-08-22 Official page ↗
Aliases
CVE-2024-21509
Ecosystem
npm
Packages
mysql2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-1321
Reviewed
2024-04-12

Affected packages

• npm mysql2: < 3.9.4 → fixed in 3.9.4

Description

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through `parserFn` in `text_parser.js` and `binary_parser.js`.

Related

Alias · CVE (1)

  • CVE-2024-21509 Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References