CVE-2024-21512 | BDVDB-2026-237779 Detail
mysql2
Description#
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact high, availability impact low. Attack vector: network.
Weaknesses#
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
References#
- https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
- https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
- https://github.com/sidorares/node-mysql2/pull/2702
- https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.