CVE-2024-21508

CRITICAL

NPM Mysql2 < 3.9.4 - Code Injection

Title source: rule

Description

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

Exploits (1)

References (6)

Scores

CVSS v3 9.8
EPSS 0.3968
EPSS Percentile 97.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (2)
n/a/mysql2 < 3.9.4
npm/mysql2 0 - 3.9.4npm
Published Apr 11, 2024
Tracked Since Feb 18, 2026