Vulnerability in mysql2 Prior to 3.9.8 Due to Prototype Pollution

CVE-2024-21512

What is CVE-2024-21512?

The vulnerability CVE-2024-21512 is found in the mysql2 package prior to version 3.9.8, and it is due to prototype pollution. This vulnerability can be exploited by adding or modifying properties of Object.prototype using a proto or constructor payload, allowing an attacker to execute arbitrary code or cause a denial of service condition on the system. The affected vendor is Node.js MySQL2 3.9.7, and the recommended action is to upgrade to the latest version available from the MySQL2 GIT Repository. Currently, there are no known exploits of this vulnerability in the wild.

News Articles

Rewterz

CVE-2024-21512

CVE-2024-21512 – Node.js MySQL2 Vulnerability - Rewterz

Node.js MySQL2 module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in nestTables.

References