p PatchFirst

CVE-2024-21511

CVE-2024-21511

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

CVSS 9.8 · Critical · EPSS 1.0% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • mysql2

    Versions
    • ≥ 0, < 3.9.7: Affected (semver)

    Update to 3.9.7

  • mysql2 npm

    Affected ranges
    • SEMVER: < 3.9.7

    Update to 3.9.7

Original sources

Check your server →