CVE-2026-107384
Reported by github_m · Published October 8, 2026
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| sqlpad | Wolfi | 7.5.7-r49 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| mariadb-corporation | mariadb-connector-nodejs | >= 3.2.0, < 3.2.5, >= 3.3.0, < 3.3.4, >= 3.4.0, < 3.4.7 |
| wolfi | sqlpad | 0 |
| mariadb-corporation | mariadb-connector-nodejs | 3.5.0-rc.0, 3.2.0, 3.3.0 |
| npm | mariadb | 3.5.0-rc.0, 3.2.0, 3.3.0 |
| chainguard | sqlpad | 0 |
Timeline
- Oct 8, 2026 CVE Published
- Oct 8, 2026 Coalition ESS Score
- Oct 9, 2026 EPSS Score (9 in total, the first dated here)
- Oct 9, 2026 CVE Updated
- Oct 31, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-107384
vulnetix vdb fixes CVE-2026-107384Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-107384/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-v6pj-gxxw-phfw x_refsource_CONFIRM
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/144b8f4ef29539a9fb4b75d972b9dcdac4088b4e x_refsource_MISC
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6743b2f4a89b074268b44c650170767f35e1fb5d x_refsource_MISC
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/8eb450972ff0f3826d7d45c071a42240798bc826 x_refsource_MISC
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b9b04ec82a60b2caf2b0c038259ca9aff5d7014a x_refsource_MISC
- https://hackerone.com/reports/3889198 x_refsource_MISC
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5 x_refsource_MISC
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4 x_refsource_MISC
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7 x_refsource_MISC
- https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4 x_refsource_MISC
- https://jira.mariadb.org/browse/CONJS-369 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-107384 advisory
- https://github.com/advisories/GHSA-v6pj-gxxw-phfw advisory