GitHub Advisoryadvisory · npm

GHSA-fpw7-j2hg-69v5 mysql2 Remote Code Execution (RCE) via the readCodeFor function

CRITICAL Published 2024-04-11 Modified 2024-04-12 Official page ↗
Aliases
CVE-2024-21508
Ecosystem
npm
Packages
mysql2
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-04-12

Affected packages

• npm mysql2: < 3.9.4 → fixed in 3.9.4

Description

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the `readCodeFor` function due to improper validation of the `supportBigNumbers` and `bigNumberStrings` values.

Related

Alias · CVE (1)

  • CVE-2024-21508 Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References