CVE-2026-107385

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107385
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107385.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107385
Aliases
Downstream
CGA (4)
Published
2026-10-08T18:38:29Z
Modified
2026-10-10T02:47:22Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
Details

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that mode is enabled, the backslash is an ordinary character, so an attacker-controlled placeholder value can close the SQL string literal and inject arbitrary SQL with the application's database privileges. The vulnerable configuration may be enabled server-wide, through connector initialization options, or with an application-issued SET sql_mode; execute() and batch() use binary protocols and are not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107385.json"
}
References

Affected packages

Git / github.com/mariadb-corporation/mariadb-connector-nodejs

Affected ranges

Type
GIT
Repo
https://github.com/mariadb-corporation/mariadb-connector-nodejs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
b65aca10b77f5ede83f16a8edd0537b2ef12a16f
Introduced
24a58245cba201da91f41f7f96f8dd165d31c6c7
Introduced
07d0183bbcf61a9cd9a5b39a74a67d676e83b4d8
Fixed
d7c1aed221af4bf811e7d13f3e29c2f7484bb0e0
Fixed
ee9b296894d0c9bcc0e0f6b9ac9316f498eecec4
Fixed
67c931b7407fc4e460aab020e7cb53bcb1c62e50
Fixed
ff43a2c80ebba9e6590afd6b9cc08ac0a290892a
Fixed
6995c8cf8e51b2ad055de63dcaa4094eebbef5ce
Fixed
7670d90949307e735c0ae148d80b3776478a599d
Fixed
95886df9fa0cca991e2be339caa6c3979be61553
Fixed
e5a9d732d9574177749488336319b73074072779
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.2.5"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.4"
        },
        {
            "introduced": "3.4.0"
        },
        {
            "fixed": "3.4.7"
        },
        {
            "introduced": "3.5.0-rc.0"
        },
        {
            "fixed": "3.5.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.7.0
2.*
2.0.3
2.0.5
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
2.3.0
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.6
3.*
3.0.0-ga
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.6
3.5.0-rc.0
3.5.1
3.5.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107385.json"