Executive brief
The mysql Node.js library contains a SQL injection vulnerability in its escape() function, which fails to properly escape object keys. An attacker could inject arbitrary SQL code by passing specially crafted input, potentially leading to unauthorized database access, data manipulation, or data exfiltration.
Technical details
The vulnerability is a SQL injection flaw (CWE-89) in the mysql.escape() function in the Node.js mysql library. The root cause is improper escaping of object keys during SQL query construction. An attacker can exploit this by supplying malicious object keys that bypass the escape mechanism, allowing arbitrary SQL injection. The attack requires control over input passed to the escape() function, but does not require authentication. The vulnerability affects all versions prior to 2.0.0-alpha8, which includes the fix.
Affected products
- npm mysql < 2.0.0-alpha8
Timeline
- 2020-09-01: disclosed
- 2.0.0-alph: patched