CVE-2026-107384 in MariaDB Connector Node.js
Summary
by MITRE • 10/08/2026
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The MariaDB Connector for Node.js serves as a critical bridge between applications built on the JavaScript runtime environment and relational databases such as MariaDB and MySQL. Within specific versions of this connector, ranging from 3.2.0 up to but not including 3.2.5, as well as in versions 3.3 through 3.4 leading up to 3.4.7 and version 3.5 up to 3.5.4, a significant security flaw exists that impacts the integrity of SQL queries when certain configuration options are enabled. The vulnerability specifically affects functionality related to permitSetMultiParamEntries, an option designed to allow applications to pass objects whose keys are expanded into a SQL SET clause for updating database records. Under normal circumstances, this feature facilitates dynamic updates by mapping object properties directly to column names and values within the update statement structure.
The core technical flaw lies in how these connector versions handle identifier escaping during the expansion of object keys into SQL identifiers. When permitSetMultiParamEntries is enabled, the application passes objects where the property names are intended to represent database column identifiers. The connector attempts to quote these identifiers to prevent syntax errors and basic injection attacks by wrapping them in backticks. However, the implementation fails to properly process these keys through the escapeId function before quoting or during the construction of the identifier string. This oversight means that if an attacker can control any part of the object key used as a column name, they can inject malicious SQL syntax directly into the query structure.
The exploitation mechanism relies on the use of backtick characters within attacker-controlled input keys. In MySQL and MariaDB dialects, identifiers are often enclosed in backticks to distinguish them from reserved keywords or special characters. If an object key contains a closing backtick character followed by arbitrary text, it effectively terminates the intended quoted identifier prematurely. The remainder of the string is then interpreted as raw SQL code rather than part of the column name. This allows for precise manipulation of the resulting UPDATE statement, enabling actions far beyond simple data modification.
The operational impact of this vulnerability is severe, primarily categorized under CWE-89 Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. Because the injected code executes with the privileges of the database user account associated with the connection, an attacker can potentially update columns that were not intended to be exposed or modifiable by the application logic. More critically, this flaw allows for arbitrary SQL execution. An adversary could append commands such as SELECT statements to exfiltrate sensitive data from other tables, INSERT statements to introduce malicious records, DELETE statements to destroy critical information, or even administrative commands if the database user has elevated privileges. This represents a complete bypass of application-level access controls and logic constraints.
It is important to note that this vulnerability is contingent on specific configuration states. The permitSetMultiParamEntries option must be explicitly enabled by the developer for the flaw to be exploitable. By default, this setting is disabled in affected versions. Furthermore, when the option is disabled, the connector utilizes a different serialization method for handling objects which does not suffer from this identifier injection weakness. Therefore, applications that do not rely on dynamic column mapping via object keys are generally unaffected by this specific vector, although general input validation remains essential for all database interactions.
To mitigate this risk, organizations using affected versions of MariaDB Connector/Node.js must upgrade to patched releases immediately. The vulnerability is resolved in version 3.2.5 and later within the 3.2 branch, as well as in versions 3.3.4, 3.4.7, and 3.5.4 for their respective branches. If upgrading is not immediately feasible, developers should ensure that permitSetMultiParamEntries remains disabled unless absolutely necessary. When this feature must be used, strict input validation on all object keys passed to the connector is required to prevent backtick characters or other SQL metacharacters from entering the identifier space. Additionally, adhering to the principle of least privilege for database accounts can limit the blast radius should an injection attempt succeed. This incident highlights the importance of rigorous escaping mechanisms in dynamic query construction and aligns with ATT&CK techniques related to command line interface exploitation and data exfiltration via SQL injection.