CVE-2026-107385: MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
When escaping string and binary parameters for the text protocol, the connector always escaped the quote character with a backslash, without ever consulting the session’s NO_BACKSLASH_ESCAPES SQL mode. The server status flag was declared (STATUS_NO_BACKSLASH_ESCAPES) but never read.
Under a server or session running with NO_BACKSLASH_ESCAPES, the backslash is an ordinary character and the quote must be escaped by doubling it. The escaped value produced by the connector therefore closed the string literal, and a value passed through a placeholder was interpreted as SQL.
All text-protocol escaping entry points were affected, including Connection.escape().
References
- github.com/advisories/GHSA-r3rv-jm3r-62q2
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6995c8cf8e51b2ad055de63dcaa4094eebbef5ce
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/7670d90949307e735c0ae148d80b3776478a599d
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/95886df9fa0cca991e2be339caa6c3979be61553
- github.com/mariadb-corporation/mariadb-connector-nodejs/commit/e5a9d732d9574177749488336319b73074072779
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7
- github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4
- github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-r3rv-jm3r-62q2
- hackerone.com/reports/3889197
- jira.mariadb.org/browse/CONJS-368
- nvd.nist.gov/vuln/detail/CVE-2026-107385
Code Behaviors & Features
Detect and mitigate CVE-2026-107385 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →