Description

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 client character sets. PacketOutputStream.writeBufferEscape in lib/io/packet-output-stream.js escaped bytes without the charset-aware getMbRecognizer logic in lib/misc/charset-mb.js. The server SQL lexer runs my_ismbchar before escape processing, so an attacker-controlled lead byte can consume the inserted 0x5C backslash as a multibyte trail byte and leave the following 0x27 quote unescaped, terminating the string literal and allowing arbitrary SQL. The default utf8mb4 character set and parameters sent through the execute binary prepared-statement path are not affected. Successful exploitation can expose or modify data available to the database account. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T23:17:08.353Z",
  "pubdate": "2026-08-28T23:17:08.353Z",
  "executiveSummary": "This vulnerability is an SQL injection flaw present in MariaDB Connector/Node.js. It occurs during client-side escaping of Buffer parameters when specific multibyte character sets are configured.\nThe vulnerability allows an attacker to bypass security filters by injecting arbitrary SQL commands, potentially leading to unauthorized data exfiltration, modification, or deletion.\nAffected versions include all releases prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3.\nThe flaw affects applications using the text protocol with client character sets 'big5', 'gbk', 'sjis', 'cp932', or 'gb18030'.\nExploitation requires the attacker to control the input buffer, allowing them to manipulate character encoding sequences to neutralize the library's escaping logic.\nThis issue is successfully mitigated by upgrading to the specified patched versions, which correctly implement charset-aware escaping.",
  "technicalDetails": "The vulnerability resides in lib/io/packet-output-stream.js within the PacketOutputStream.writeBufferEscape function. The root cause is a failure to utilize the charset-aware getMbRecognizer logic defined in lib/misc/charset-mb.js when processing client-side Buffer escapes.\nUnder specific character sets (big5, gbk, sjis, cp932, gb18030), the connector fails to identify multibyte character structures correctly during the escaping process. In MariaDB, the server-side SQL lexer executes the my_ismbchar function to analyze incoming byte sequences before final escape processing.\nAn attacker can exploit this by providing a crafted Buffer containing a lead byte of a multibyte character. When the connector attempts to escape the input, it inserts a 0x5C backslash to escape a quote. However, because the client-side logic is not charset-aware, the 0x5C backslash is consumed by the server as a trail byte for the attacker-provided lead byte. This results in the subsequent 0x27 single-quote character remaining unescaped.\nThe unescaped quote terminates the intended string literal prematurely, allowing the attacker to break out of the context and append arbitrary SQL commands. This effectively bypasses input sanitization mechanisms.\nThe attack flow follows these steps: 1) The application processes user-supplied binary data as a Buffer; 2) The client sets the character encoding to a susceptible multibyte set; 3) The attacker provides a payload containing a lead byte designed to 'absorb' the security-injected backslash; 4) The server parses the payload, interpreting the backslash as part of a multibyte character; 5) The injected 0x27 quote is treated as a delimiter rather than literal text; 6) The database executes the malicious SQL injected by the attacker.\nThis vulnerability is limited to the text protocol path. It does not affect binary prepared statements or the default utf8mb4 character set. The impact is significant, as it grants attackers the ability to manipulate database queries, potentially leading to full compromise of the database account's capabilities, including data theft or administrative command execution."
}