CVE-2024-21511

CRITICAL

mysql2 < 3.9.7 - Arbitrary Code Injection via Timezone Parameter

Title source: llm

Description

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

References (4)

Core 4

Core References

Third Party Advisory

https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046

Patch

https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713

View Patch ZIP pw:eip

Issue Tracking

https://github.com/sidorares/node-mysql2/pull/2608

Release Notes

https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7

Scores

CVSS v3 9.8

EPSS 0.0017

EPSS Percentile 38.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-94

Status published

Products (2)

n/a/mysql2 < 3.9.7

npm/mysql2 0 - 3.9.7npm

Published Apr 23, 2024

Tracked Since Feb 18, 2026