SQL Injection Risk in MariaDB Connector for Node.js by MariaDB
CVE-2026-107385
7.4HIGH
What is CVE-2026-107385?
The vulnerability in MariaDB Connector/Node.js allows attackers to exploit the incorrect handling of backslash characters in text-protocol escaping, which can lead to SQL injection. Specifically, when NOT_BACKSLASH_ESCAPES mode is enabled, attacker-controlled placeholder values can terminate SQL string literals, permitting unauthorized access and manipulation of the database. This flaw affects all versions prior to updates 3.2.5, 3.3.4, 3.4.7, and 3.5.4. Users are advised to upgrade to these versions to mitigate the risk.
Affected Version(s)
mariadb-connector-nodejs < 3.2.5 < 3.2.5
mariadb-connector-nodejs >= 3.3.0, < 3.3.4 < 3.3.0, 3.3.4
mariadb-connector-nodejs >= 3.4.0, < 3.4.7 < 3.4.0, 3.4.7