CVE-2026-107385 in MariaDB Connector Node.js
Summary
by MITRE • 10/08/2026
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that mode is enabled, the backslash is an ordinary character, so an attacker-controlled placeholder value can close the SQL string literal and inject arbitrary SQL with the application's database privileges. The vulnerable configuration may be enabled server-wide, through connector initialization options, or with an application-issued SET sql_mode; execute() and batch() use binary protocols and are not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The MariaDB Connector for Node.js serves as a critical bridge between applications built on the Node.js runtime environment and MariaDB or MySQL database servers. This connector facilitates data exchange by translating application requests into SQL commands that the database engine can process. A significant security flaw was identified in versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 regarding how the library handles text-protocol escaping for string literals. The core technical deficiency lies in the implementation of the escape logic within functions such as Connection.escape(), where the connector consistently prefixes quotes with a backslash character regardless of the database session's configuration settings. Specifically, it fails to honor the NO_BACKSLASH_ESCAPES SQL mode when this setting is active on the server side or configured via initialization options.
In standard MySQL and MariaDB configurations, the NO_BACKSLASH_ESCAPES mode alters how escape sequences are interpreted by the database engine. When this mode is enabled, the backslash character loses its special meaning as an escape prefix and is treated merely as a regular literal character. Consequently, if an attacker can control input that passes through the vulnerable escaping function, they can inject a closing quote followed by malicious SQL syntax without needing to use backslashes for evasion. Because the connector blindly adds backslashes before quotes even when this mode is active, it creates a predictable pattern that allows attackers to break out of string literals and append arbitrary commands to the original query structure. This behavior effectively neutralizes one layer of defense against injection attacks by ignoring server-side configuration directives intended to enforce stricter escaping rules.
The operational impact of this vulnerability is severe, as it directly enables SQL Injection attacks under specific but common configurations. An attacker who can supply user-controlled data to any function that utilizes the text-protocol escape mechanism can manipulate the resulting SQL statement. This manipulation allows for unauthorized access to sensitive database records, modification or deletion of critical data, and potentially full compromise of the underlying server depending on the privileges assigned to the application's database account. It is important to note that this vulnerability does not affect all query execution methods within the connector; specifically, execute() and batch() functions utilize binary protocols which handle parameter binding differently and are therefore immune to this specific text-escaping flaw. The risk persists if the vulnerable configuration is enabled server-wide, passed during connector initialization, or set dynamically via application-issued SET sql_mode commands prior to executing queries through affected methods.
To mitigate this vulnerability, organizations must upgrade their MariaDB Connector/Node.js installations to version 3.2.5, 3.3.4, 3.4.7, or 3.5.4 and later releases where the escaping logic has been corrected to respect the NO_BACKSLASH_ESCAPES mode. In addition to upgrading, developers should ensure that their applications consistently use parameterized queries through binary protocol methods like execute() whenever possible, as these are not susceptible to this specific text-escaping flaw. From a classification perspective, this issue aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and maps to the ATT&CK technique T1059 Command Scripting for executing injected commands within database environments. Maintaining up-to-date dependencies is essential to prevent exploitation of such logic errors that undermine input validation mechanisms.