MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLASH_ESCAPES mode, including in Connection.escape(). When that mode is enabled, the backslash is an ordinary character, so an attacker-controlled placeholder value can close the SQL string literal and inject arbitrary SQL with the application's database privileges. The vulnerable configuration may be enabled server-wide, through connector initialization options, or with an application-issued SET sql_mode; execute() and batch() use binary protocols and are not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
CVSS v4.0 Metrics
Exploitability
Attack VectorNetwork
ComplexityHigh
RequirementsPresent
PrivilegesNone
User InteractionNone
Threat
Exploit MaturityUnreported
Vulnerable System
ConfidentialityNone
IntegrityHigh
AvailabilityHigh
Subsequent System
ConfidentialityNone
IntegrityNone
AvailabilityNone
Supplemental
SafetyNegligible
AutomatableYes
RecoveryAutomatic
Value DensityConcentrated
UrgencyMedium
Change Log
| Date | Source | Changes | Score |
|---|
| 2026-10-08 | cve.org | initial, patch: Unavailable, ncsc_hh: 42.2 | 4.9 |
Affected Software
| Vendor | Product | Version |
|---|
| mariadb-corporation | mariadb-connector-nodejs | < 3.2.5 |
| mariadb-corporation | mariadb-connector-nodejs | ≥ 3.3.0, < 3.3.4 |
| mariadb-corporation | mariadb-connector-nodejs | ≥ 3.4.0, < 3.4.7 |
| mariadb-corporation | mariadb-connector-nodejs | ≥ 3.5.0, < 3.5.4 |
Published: 2026-10-08
