MariaDB Connector/Node.js: SQL injection via object keys in SET clause
Summary
MariaDB Connector/Node.js builds SET clauses from object keys when the non-default option permitSetMultiParamEntries is enabled, but it does not escape those keys as identifiers. An attacker who controls a key can insert a backtick to close the identifier and inject SQL, which can update columns the application did not intend to expose and run arbitrary SQL with the database user's privileges. The issue requires an application that enables this option and passes attacker-influenced keys into it.
Affected
- mariadb-connector-nodejs 3.2.0 to before 3.2.5
- mariadb-connector-nodejs 3.3.0 to before 3.3.4
- mariadb-connector-nodejs 3.4.0 to before 3.4.7
- mariadb-connector-nodejs 3.5.0-rc.0 to before 3.5.4
- Only applications with permitSetMultiParamEntries enabled (disabled by default)
- Versions 2.x are not listed as affected by the vendor; verify installed versions
Fixed in
- Upgrade to 3.2.5, 3.3.4, 3.4.7 or 3.5.4 (or later)
Workaround
- Keep permitSetMultiParamEntries disabled (default setting)
- Search code for permitSetMultiParamEntries and remove it where not needed
- Ensure no user-controlled keys reach objects passed as query parameters
Exploitation
- No public proof of concept known
- No evidence of exploitation in the wild found
- CISA SSVC: exploitation none, automatable no, technical impact total
- EPSS low (0.00447)
Our recommendation
- Check whether any application uses the mariadb or mysql Node.js connector with permitSetMultiParamEntries enabled
- Update to 3.2.5, 3.3.4, 3.4.7 or 3.5.4 or later
- Until patched, disable the option and ensure user input cannot control object keys
- Run application database accounts with least privilege
- Verify the CISA KEV catalogue before closing the ticket
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v6pj-gxxw-phfw github.com
- Fix commit 144b8f4 (escapeId for object keys) github.com
- Release 3.2.5 github.com
- Release 3.3.4 github.com
- Release 3.4.7 github.com
- Release 3.5.4 github.com
- OSV entry BIT-mariadb-2026-107384 osv.dev
- Tracking ticket CONJS-369 jira.mariadb.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:31.
Original description (NVD)
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
NVD references (11)
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/144b8f4ef29539a9fb4b75d972b9dcdac4088b…
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6743b2f4a89b074268b44c650170767f35e1fb…
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/8eb450972ff0f3826d7d45c071a42240798bc8…
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b9b04ec82a60b2caf2b0c038259ca9aff5d701…
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-v6pj-gxxw-phfw
- https://hackerone.com/reports/3889198
- https://jira.mariadb.org/browse/CONJS-369
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.