# CVE-2015-9244: mysql SQL injection in escape function

Source: https://junglewise.ai/threats/cve-2015-9244-mysql-sql-injection-in-escape-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2015-9244 · Severity: info · Published 2020-09-01

The mysql Node.js library contains a SQL injection vulnerability in its escape() function, which fails to properly escape object keys. An attacker could inject arbitrary SQL code by passing specially crafted input, potentially leading to unauthorized database access, data manipulation, or data exfiltration.

Technologies: [mysql (npm)](https://junglewise.ai/threats/technologies/npm-mysql). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2015-9244 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2015-9244 being exploited in the wild.

**How severe is CVE-2015-9244?** Informational severity, published 1 September 2020.

**Which products and versions are affected?** mysql (npm) SEMVER:introduced=0,fixed=2.0.0-alpha8.

**Is there a fix for CVE-2015-9244?** Yes. mysql (npm): upgrade to 2.0.0-alpha8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2015-9244 attacked?** It is attacked over the network.

**Am I affected by CVE-2015-9244?** Check whether you run mysql (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mysql (npm): upgrade to 2.0.0-alpha8 or later

  ```sh
  npm install mysql@2.0.0-alpha8
  ```


## Technical details

The vulnerability is a SQL injection flaw (CWE-89) in the mysql.escape() function in the Node.js mysql library. The root cause is improper escaping of object keys during SQL query construction. An attacker can exploit this by supplying malicious object keys that bypass the escape mechanism, allowing arbitrary SQL injection. The attack requires control over input passed to the escape() function, but does not require authentication. The vulnerability affects all versions prior to 2.0.0-alpha8, which includes the fix.

## Affected products

- npm mysql < 2.0.0-alpha8

## Identifiers

- CVE-2015-9244
- GHSA-fvq6-55gv-jx9f

## Timeline

- 2020-09-01: disclosed
- 2.0.0-alph: patched

## References

- [https://github.com/felixge/node-mysql/issues/342](https://github.com/felixge/node-mysql/issues/342)

## Related threats

- [MySQL for Node.js LOAD DATA LOCAL INFILE information disclosure](https://junglewise.ai/threats/cve-2019-14939-mysql-for-node-js-load-data-local-infile-information-disclosure)
- [npm mysql information disclosure via uninitialized buffer](https://junglewise.ai/threats/npm-mysql-information-disclosure-via-uninitialized-buffer-7b0e338d)