Description
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
Scores
CVSS v3
8.2
EPSS
0.6834
EPSS Percentile
98.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-1321
Status
published
Products (3)
n/a/mysql2
< 3.9.8
n/a/org.webjars.npm:mysql2
npm/mysql2
0 - 3.9.8npm
Published
May 29, 2024
Tracked Since
Feb 18, 2026