CVE-2026-107384

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-107384

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107384.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-107384

Aliases

GHSA-v6pj-gxxw-phfw

Downstream

CGA (4)

Published

2026-10-08T18:32:30Z

Modified

2026-10-10T02:47:22Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

Details

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107384.json"
}

References

Affected packages

Git / github.com/mariadb-corporation/mariadb-connector-nodejs

Affected ranges

Type

GIT

Repo

https://github.com/mariadb-corporation/mariadb-connector-nodejs

Events

Introduced

bb5f90e905a7deb6e5ddf9b99ccbbb1c093d6acd

Introduced

b65aca10b77f5ede83f16a8edd0537b2ef12a16f

Introduced

24a58245cba201da91f41f7f96f8dd165d31c6c7

Introduced

07d0183bbcf61a9cd9a5b39a74a67d676e83b4d8

Fixed

d7c1aed221af4bf811e7d13f3e29c2f7484bb0e0

Fixed

ee9b296894d0c9bcc0e0f6b9ac9316f498eecec4

Fixed

67c931b7407fc4e460aab020e7cb53bcb1c62e50

Fixed

ff43a2c80ebba9e6590afd6b9cc08ac0a290892a

Fixed

144b8f4ef29539a9fb4b75d972b9dcdac4088b4e

Fixed

6743b2f4a89b074268b44c650170767f35e1fb5d

Fixed

8eb450972ff0f3826d7d45c071a42240798bc826

Fixed

b9b04ec82a60b2caf2b0c038259ca9aff5d7014a

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.5"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.4"
        },
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.4.7"
        },
        {
            "introduced": "3.5.0-rc.0"
        },
        {
            "fixed": "3.5.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*

3.2.0

3.2.1

3.2.2

3.2.3

3.2.4

3.3.0

3.3.1

3.3.2

3.3.3

3.4.0

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

3.4.6

3.5.0-rc.0

3.5.1

3.5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107384.json"