{"schema":"threatline.record/2","record":{"id":"CVE-2026-107385","aliases":["BIT-mariadb-2026-107385","BIT-mariadb-min-2026-107385","BIT-mysql-client-2026-107385","GHSA-r3rv-jm3r-62q2"],"summary":"MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES","details":"### Description\nWhen escaping string and binary parameters for the text protocol, the connector always escaped the quote character with a backslash, without ever consulting the session's NO_BACKSLASH_ESCAPES SQL mode. The server status flag was declared (STATUS_NO_BACKSLASH_ESCAPES) but never read.\n\nUnder a server or session running with NO_BACKSLASH_ESCAPES, the backslash is an ordinary character and the quote must be escaped by doubling it. The escaped value produced by the connector therefore closed the string literal, and a value passed through a placeholder was interpreted as SQL.\n\nAll text-protocol escaping entry points were affected, including Connection.escape().\n\n### Impact\nAn attacker able to influence any value the application passes as a query parameter could execute arbitrary SQL with the privileges of the application's database user: read, modify or delete any data reachable by that connection.\n\nExposure requires a deployment where NO_BACKSLASH_ESCAPES is enabled — server-wide, through the connector's sessionVariables / initSql options, or by an application-issued SET sql_mode. It is not implied by the ANSI, ORACLE or TRADITIONAL compound modes on MariaDB 11.4, so it has to be set deliberately. Where it is enabled, no unusual application code is needed: the standard placeholder API is the injection point.\n\nexecute() and batch() are not affected: the binary prepared-statement and bulk protocols send parameter values out of band.\n\n### Resolution\nThe escaping routines now branch on the session status flag, doubling the quote and leaving the backslash untouched when NO_BACKSLASH_ESCAPES is set\n\n### Workarounds\nUse execute() or batch(), or do not enable NO_BACKSLASH_ESCAPES, until upgraded.\n\n### Credit\nReported by fg0x0.","categories":["Databases"],"product":"mariadb","vendor":"mariadb-corporation","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-08T19:42:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"mariadb"},"range":"< 3.2.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-08T19:42:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"mariadb"},"range":">= 3.3.0, < 3.3.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-08T19:42:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"mariadb"},"range":">= 3.4.0, < 3.4.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-08T19:42:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"mariadb"},"range":">= 3.5.0-rc.0, < 3.5.4"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-107385","source_modified_at":"2026-10-09T11:45:28.671Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"mariadb-connector-nodejs","vendor":"mariadb-corporation","versions":[{"version":"< 3.2.5","status":"affected"},{"version":">= 3.3.0, < 3.3.4","status":"affected"},{"version":">= 3.4.0, < 3.4.7","status":"affected"},{"version":">= 3.5.0-rc.0, < 3.5.4","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-16T09:55:57.878893396Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"mariadb","ecosystem":"npm","purl":"pkg:npm/mariadb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.5"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-16T09:55:57.878893396Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"mariadb","ecosystem":"npm","purl":"pkg:npm/mariadb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.3.0"},{"fixed":"3.3.4"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-16T09:55:57.878893396Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"mariadb","ecosystem":"npm","purl":"pkg:npm/mariadb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.4.0"},{"fixed":"3.4.7"}]}],"versions":[]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-16T09:55:57.878893396Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"mariadb","ecosystem":"npm","purl":"pkg:npm/mariadb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.5.0-rc.0"},{"fixed":"3.5.4"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-08T19:42:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"mariadb"},"version":"3.2.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-08T19:42:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"mariadb"},"version":"3.3.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-08T19:42:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"mariadb"},"version":"3.4.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-08T19:42:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"mariadb"},"version":"3.5.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-16T09:55:57.878893396Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"mariadb","ecosystem":"npm","purl":"pkg:npm/mariadb"},"version":"3.2.5"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-16T09:55:57.878893396Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"mariadb","ecosystem":"npm","purl":"pkg:npm/mariadb"},"version":"3.3.4"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-16T09:55:57.878893396Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"mariadb","ecosystem":"npm","purl":"pkg:npm/mariadb"},"version":"3.4.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-r3rv-jm3r-62q2","source_modified_at":"2026-10-16T09:55:57.878893396Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"mariadb","ecosystem":"npm","purl":"pkg:npm/mariadb"},"version":"3.5.4"}],"cvss":7.4,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00438,"percentile":0.37073,"score_date":"2026-10-23"},"published_at":"2026-10-08T18:38:29.490Z","modified_at":"2026-10-16T09:55:57.878893396Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-08T19:42:30Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-107385","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-09T11:45:28.671Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-r3rv-jm3r-62q2","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-16T09:55:57.878893396Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107385","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-r3rv-jm3r-62q2","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6995c8cf8e51b2ad055de63dcaa4094eebbef5ce","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/7670d90949307e735c0ae148d80b3776478a599d","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/95886df9fa0cca991e2be339caa6c3979be61553","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/e5a9d732d9574177749488336319b73074072779","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://hackerone.com/reports/3889197","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://jira.mariadb.org/browse/CONJS-368","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-r3rv-jm3r-62q2","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-09T11:45:07.704481Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-16T09:55:57.878893396Z","content_hash":"c6547909ed53c3cbf54df61d2927a83a4bbcdb50906bd06edaaf51dbb7896077"}}