CVE-2026-107384

{
  "etk_id": "ETK-2026-1034",
  "cve_id": "CVE-2026-107384",
  "display_id": "CVE-2026-107384",
  "ghsa_id": "GHSA-v6pj-gxxw-phfw",
  "euvd_id": "EUVD-2026-95143",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in MariaDB Connector/Node.js parameter expansion",
  "summary": "The npm mariadb package can mishandle object property names used for SET-clause parameter expansion when permitSetMultiParamEntries is enabled. An attacker able to control those names may modify unintended database fields or cause additional SQL to run with the application's database privileges.",
  "mitigation": "Upgrade mariadb to 3.2.5, 3.3.4, 3.4.7, or 3.5.4, as appropriate for your release line. Until upgraded, disable permitSetMultiParamEntries or allow only approved column names in object keys passed to queries.",
  "vendor": "npm",
  "product": "npm:mariadb",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.2.0, < 3.2.5"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.2.5"
      ],
      "package_name": "mariadb",
      "purl": "pkg:npm/mariadb"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.3.0, < 3.3.4"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.3.4"
      ],
      "package_name": "mariadb",
      "purl": "pkg:npm/mariadb"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.4.0, < 3.4.7"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.4.7"
      ],
      "package_name": "mariadb",
      "purl": "pkg:npm/mariadb"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.5.0-rc.0, < 3.5.4"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.5.4"
      ],
      "package_name": "mariadb",
      "purl": "pkg:npm/mariadb"
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0045,
  "epss_percentile": 0.3759,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 12.306877333333333,
  "t0_at": "2026-10-08T18:32:30.156000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-09T03:25:08.037846+00:00",
      "days": 0.3698828917361111,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T18:32:30.156000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-08T18:32:30.156000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T18:32:30.156000+00:00",
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-v6pj-gxxw-phfw"
    }
  }
}