BIT-mysql-client-2026-107385

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/mysql-client/BIT-mysql-client-2026-107385.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-mysql-client-2026-107385
Aliases
Published
2026-10-16T08:44:12Z
Modified
2026-10-16T09:55:57Z
Summary
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
Details

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that mode is enabled, the backslash is an ordinary character, so an attacker-controlled placeholder value can close the SQL string literal and inject arbitrary SQL with the application's database privileges. The vulnerable configuration may be enabled server-wide, through connector initialization options, or with an application-issued SET sql_mode; execute() and batch() use binary protocols and are not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:node.js:*:*"
    ],
    "severity":  "High"
}
References

Affected packages

Bitnami / mysql-client

Package

Name
mysql-client
Purl
pkg:bitnami/mysql-client

Severity

  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.5
Introduced
3.3.0
Fixed
3.3.4
Introduced
3.4.0
Fixed
3.4.7
Introduced
3.5.0
Fixed
3.5.4

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/mysql-client/BIT-mysql-client-2026-107385.json"