CVE-2024-21512 mysql2 vulnerable to Prototype Pollution
Prototype pollution in mysql2 allows attackers to modify object prototypes when nestTables is enabled, potentially leading to application instability or logic errors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21512?
CVE-2024-21512 is a high-severity vulnerability in mysql2, published on 29 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
Weakness: CWE-1321
Which versions are affected by CVE-2024-21512?
2 open source packages ship an affected version, including mysql2.
| Package | Affected | Fixed in |
|---|---|---|
mysql2 npm | All versions | 3.9.8 |
mysql2 npm | All versions | 3.9.8 |
How do I fix CVE-2024-21512?
Upgrade mysql2 to 3.9.8 or later.
Is CVE-2024-21512 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21512 exists.
Sources
Also known as GHSA-pmh2-wpjm-fj45, ROOT-APP-NPM-CVE-2024-21512.