CVE-2024-21511

9.8 CRITICAL

Published: April 23, 2024 Modified: April 15, 2026

Description

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713

Source: report@snyk.io

https://github.com/sidorares/node-mysql2/pull/2608

Source: report@snyk.io

https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7

Source: report@snyk.io

https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046

Source: report@snyk.io

https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/sidorares/node-mysql2/pull/2608

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/sidorares/node-mysql2/releases/tag/v3.9.7

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046

Source: af854a3a-2127-422b-91ae-364da2661108

8 reference(s) from NVD

Quick Stats

CVSS v3 Score

9.8 / 10.0

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-94

Related CVEs