CVE-2026-107384: MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
With the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped.
A key containing a backtick therefore closed the identifier, and the remainder of the key was parsed as SQL. The connector’s own identifier escaper (escapeId, which correctly doubles backticks) existed but was not called from any of the three sites. This is an incomplete fix of GitHub issue #252, which corrected escapeId itself in 2023 but left these hand-built call sites unchanged.
References
- github.com/advisories/GHSA-v6pj-gxxw-phfw
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/144b8f4ef29539a9fb4b75d972b9dcdac4088b4e
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6743b2f4a89b074268b44c650170767f35e1fb5d
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/8eb450972ff0f3826d7d45c071a42240798bc826
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b9b04ec82a60b2caf2b0c038259ca9aff5d7014a
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4
- github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-v6pj-gxxw-phfw
- hackerone.com/reports/3889198
- jira.mariadb.org/browse/CONJS-369
- nvd.nist.gov/vuln/detail/CVE-2026-107384
Code Behaviors & Features
Detect and mitigate CVE-2026-107384 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →