{"items":[{"id":"NVI-00011838","kind":"vulnerability","title":"MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-v6pj-gxxw-phfw","CVE-2026-107384"],"plain_summary":"GitHub lists this reviewed advisory for mariadb, mariadb, mariadb, mariadb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-33752123c1ceb3b67d4646d4fbfb7e44"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-08T19:42:25.000Z","value":"8.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4090f50ef00b86fe1fc567a0f24938a4"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.447%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.38927. Missing scores are unknown.","source_id":"sr-33752123c1ceb3b67d4646d4fbfb7e44"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4090f50ef00b86fe1fc567a0f24938a4","url":"https://github.com/advisories/GHSA-v6pj-gxxw-phfw","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-v6pj-gxxw-phfw","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:23.763Z"},{"id":"sr-33752123c1ceb3b67d4646d4fbfb7e44","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-107384","publisher":"FIRST EPSS","observed_at":"2026-11-01T01:39:43.065Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4090f50ef00b86fe1fc567a0f24938a4"],"technology":"mariadb","known_exclusions":[],"conditions_summary":"### Description\nWith the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped.\n\nA key containing a backtick therefore closed the identifier, and the remainder of the key was parsed as SQL. The connector's own identifier escaper (escapeId, which correctly doubles backticks) existed but was not called from any of the three sites. This is an incomplete fix of GitHub issue #252, which corrected escapeId itself in 2023 but left these hand-built call sites unchanged.\n\n### Impact\n\nAn application that enables permitSetMultiParamEntries and passes an object with attacker-influenced keys into a statement such as conn.query('UPDATE users SET ? WHERE id = ?', [body, id]) allows the caller to write columns the application never intended to expose — a role, balance or password column — and to append arbitrary SQL to the statement, since the injected text is not confined to an assignment.\n\nExposure requires the option to be enabled: it i","public_affected_ranges":[">= 3.2.0, < 3.2.5"]},{"certainty":"source_listed","source_ids":["sr-4090f50ef00b86fe1fc567a0f24938a4"],"technology":"mariadb","known_exclusions":[],"conditions_summary":"### Description\nWith the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped.\n\nA key containing a backtick therefore closed the identifier, and the remainder of the key was parsed as SQL. The connector's own identifier escaper (escapeId, which correctly doubles backticks) existed but was not called from any of the three sites. This is an incomplete fix of GitHub issue #252, which corrected escapeId itself in 2023 but left these hand-built call sites unchanged.\n\n### Impact\n\nAn application that enables permitSetMultiParamEntries and passes an object with attacker-influenced keys into a statement such as conn.query('UPDATE users SET ? WHERE id = ?', [body, id]) allows the caller to write columns the application never intended to expose — a role, balance or password column — and to append arbitrary SQL to the statement, since the injected text is not confined to an assignment.\n\nExposure requires the option to be enabled: it i","public_affected_ranges":[">= 3.3.0, < 3.3.4"]},{"certainty":"source_listed","source_ids":["sr-4090f50ef00b86fe1fc567a0f24938a4"],"technology":"mariadb","known_exclusions":[],"conditions_summary":"### Description\nWith the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped.\n\nA key containing a backtick therefore closed the identifier, and the remainder of the key was parsed as SQL. The connector's own identifier escaper (escapeId, which correctly doubles backticks) existed but was not called from any of the three sites. This is an incomplete fix of GitHub issue #252, which corrected escapeId itself in 2023 but left these hand-built call sites unchanged.\n\n### Impact\n\nAn application that enables permitSetMultiParamEntries and passes an object with attacker-influenced keys into a statement such as conn.query('UPDATE users SET ? WHERE id = ?', [body, id]) allows the caller to write columns the application never intended to expose — a role, balance or password column — and to append arbitrary SQL to the statement, since the injected text is not confined to an assignment.\n\nExposure requires the option to be enabled: it i","public_affected_ranges":[">= 3.4.0, < 3.4.7"]},{"certainty":"source_listed","source_ids":["sr-4090f50ef00b86fe1fc567a0f24938a4"],"technology":"mariadb","known_exclusions":[],"conditions_summary":"### Description\nWith the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped.\n\nA key containing a backtick therefore closed the identifier, and the remainder of the key was parsed as SQL. The connector's own identifier escaper (escapeId, which correctly doubles backticks) existed but was not called from any of the three sites. This is an incomplete fix of GitHub issue #252, which corrected escapeId itself in 2023 but left these hand-built call sites unchanged.\n\n### Impact\n\nAn application that enables permitSetMultiParamEntries and passes an object with attacker-influenced keys into a statement such as conn.query('UPDATE users SET ? WHERE id = ?', [body, id]) allows the caller to write columns the application never intended to expose — a role, balance or password column — and to append arbitrary SQL to the statement, since the injected text is not confined to an assignment.\n\nExposure requires the option to be enabled: it i","public_affected_ranges":[">= 3.5.0-rc.0, < 3.5.4"]}],"null_published_at":"2026-11-01T14:34:14.119Z","source_updated_at":"2026-10-08T19:42:25.000Z","source_disclosed_at":"2026-10-08T19:42:23.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T00:58:23.763Z"},{"id":"NVI-00011838","kind":"vulnerability","title":"MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-v6pj-gxxw-phfw","CVE-2026-107384"],"plain_summary":"GitHub lists this reviewed advisory for mariadb, mariadb, mariadb, mariadb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4090f50ef00b86fe1fc567a0f24938a4"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-08T19:42:25.000Z","value":"8.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4090f50ef00b86fe1fc567a0f24938a4"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4090f50ef00b86fe1fc567a0f24938a4","url":"https://github.com/advisories/GHSA-v6pj-gxxw-phfw","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-v6pj-gxxw-phfw","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:23.763Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4090f50ef00b86fe1fc567a0f24938a4"],"technology":"mariadb","known_exclusions":[],"conditions_summary":"### Description\nWith the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped.\n\nA key containing a backtick therefore closed the identifier, and the remainder of the key was parsed as SQL. The connector's own identifier escaper (escapeId, which correctly doubles backticks) existed but was not called from any of the three sites. This is an incomplete fix of GitHub issue #252, which corrected escapeId itself in 2023 but left these hand-built call sites unchanged.\n\n### Impact\n\nAn application that enables permitSetMultiParamEntries and passes an object with attacker-influenced keys into a statement such as conn.query('UPDATE users SET ? WHERE id = ?', [body, id]) allows the caller to write columns the application never intended to expose — a role, balance or password column — and to append arbitrary SQL to the statement, since the injected text is not confined to an assignment.\n\nExposure requires the option to be enabled: it i","public_affected_ranges":[">= 3.2.0, < 3.2.5"]},{"certainty":"source_listed","source_ids":["sr-4090f50ef00b86fe1fc567a0f24938a4"],"technology":"mariadb","known_exclusions":[],"conditions_summary":"### Description\nWith the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped.\n\nA key containing a backtick therefore closed the identifier, and the remainder of the key was parsed as SQL. The connector's own identifier escaper (escapeId, which correctly doubles backticks) existed but was not called from any of the three sites. This is an incomplete fix of GitHub issue #252, which corrected escapeId itself in 2023 but left these hand-built call sites unchanged.\n\n### Impact\n\nAn application that enables permitSetMultiParamEntries and passes an object with attacker-influenced keys into a statement such as conn.query('UPDATE users SET ? WHERE id = ?', [body, id]) allows the caller to write columns the application never intended to expose — a role, balance or password column — and to append arbitrary SQL to the statement, since the injected text is not confined to an assignment.\n\nExposure requires the option to be enabled: it i","public_affected_ranges":[">= 3.3.0, < 3.3.4"]},{"certainty":"source_listed","source_ids":["sr-4090f50ef00b86fe1fc567a0f24938a4"],"technology":"mariadb","known_exclusions":[],"conditions_summary":"### Description\nWith the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped.\n\nA key containing a backtick therefore closed the identifier, and the remainder of the key was parsed as SQL. The connector's own identifier escaper (escapeId, which correctly doubles backticks) existed but was not called from any of the three sites. This is an incomplete fix of GitHub issue #252, which corrected escapeId itself in 2023 but left these hand-built call sites unchanged.\n\n### Impact\n\nAn application that enables permitSetMultiParamEntries and passes an object with attacker-influenced keys into a statement such as conn.query('UPDATE users SET ? WHERE id = ?', [body, id]) allows the caller to write columns the application never intended to expose — a role, balance or password column — and to append arbitrary SQL to the statement, since the injected text is not confined to an assignment.\n\nExposure requires the option to be enabled: it i","public_affected_ranges":[">= 3.4.0, < 3.4.7"]},{"certainty":"source_listed","source_ids":["sr-4090f50ef00b86fe1fc567a0f24938a4"],"technology":"mariadb","known_exclusions":[],"conditions_summary":"### Description\nWith the non-default permitSetMultiParamEntries option enabled, an object passed as a query parameter is expanded into a SET clause, each key becoming a column name. The three code paths implementing that expansion built the backtick-quoted identifier by hand and wrote the key out unescaped, while only the value was escaped.\n\nA key containing a backtick therefore closed the identifier, and the remainder of the key was parsed as SQL. The connector's own identifier escaper (escapeId, which correctly doubles backticks) existed but was not called from any of the three sites. This is an incomplete fix of GitHub issue #252, which corrected escapeId itself in 2023 but left these hand-built call sites unchanged.\n\n### Impact\n\nAn application that enables permitSetMultiParamEntries and passes an object with attacker-influenced keys into a statement such as conn.query('UPDATE users SET ? WHERE id = ?', [body, id]) allows the caller to write columns the application never intended to expose — a role, balance or password column — and to append arbitrary SQL to the statement, since the injected text is not confined to an assignment.\n\nExposure requires the option to be enabled: it i","public_affected_ranges":[">= 3.5.0-rc.0, < 3.5.4"]}],"null_published_at":"2026-11-01T01:03:56.609Z","source_updated_at":"2026-10-08T19:42:25.000Z","source_disclosed_at":"2026-10-08T19:42:23.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:58:23.763Z"}],"next_cursor":null,"snapshot_revision":"42594"}