CVE-2026-107384 · AETERNAE Research

Disclosure summary

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

Source-reported weakness categories

CWE-89

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

NIST National Vulnerability Database · NVD-CVE-2026-107384

Open original source · Updated Oct 09, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

GitHub Reviewed Security Advisories · GHSA-v6pj-gxxw-phfw

Open original source · Updated Oct 08, 2026

MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

Source severity: HIGH / 0

Ecosystem	Package	Affected range	First patched
npm	mariadb	>= 3.2.0, < 3.2.5	3.2.5
npm	mariadb	>= 3.3.0, < 3.3.4	3.3.4
npm	mariadb	>= 3.4.0, < 3.4.7	3.4.7
npm	mariadb	>= 3.5.0-rc.0, < 3.5.4	3.5.4

Original records & references

PUBLISHED 2026-10-08T15:17:00-04:00
MODIFIED 2026-10-09T15:16:41-04:00
INGESTED 2026-10-10T20:55:03-04:00

CVE-2026-107384.

Disclosure summary

Source-reported weakness categories

Source-specific records & product guidance

Original records & references