CVE-2026-107385 · AETERNAE Research

Disclosure summary

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that mode is enabled, the backslash is an ordinary character, so an attacker-controlled placeholder value can close the SQL string literal and inject arbitrary SQL with the application's database privileges. The vulnerable configuration may be enabled server-wide, through connector initialization options, or with an application-issued SET sql_mode; execute() and batch() use binary protocols and are not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.

Source-reported weakness categories

CWE-89

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

NIST National Vulnerability Database · NVD-CVE-2026-107385

Open original source · Updated Oct 09, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

GitHub Reviewed Security Advisories · GHSA-r3rv-jm3r-62q2

Open original source · Updated Oct 08, 2026

MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

Source severity: HIGH / 0

Ecosystem	Package	Affected range	First patched
npm	mariadb	< 3.2.5	3.2.5
npm	mariadb	>= 3.3.0, < 3.3.4	3.3.4
npm	mariadb	>= 3.4.0, < 3.4.7	3.4.7
npm	mariadb	>= 3.5.0-rc.0, < 3.5.4	3.5.4

Original records & references

PUBLISHED 2026-10-08T15:17:01-04:00
MODIFIED 2026-10-09T08:17:08-04:00
INGESTED 2026-10-10T20:55:03-04:00

CVE-2026-107385.

Disclosure summary

Source-reported weakness categories

Source-specific records & product guidance

Original records & references