Skip to content
OpenAdvisories

Package · npm

mysql2

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-21511

    MySQL2 for Node Arbitrary Code Injection

    Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

    sqlpad sqlpad-compat mysql2 Wolfi npm
  • Critical 9.8
    CVE-2024-21508

    mysql2 Remote Code Execution (RCE) via the readCodeFor function

    Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

    sqlpad sqlpad-compat mysql2 Wolfi npm