Executive brief
MariaDB Connector/Node.js is a database driver used by Node.js applications to connect to MariaDB databases. The connector has a flaw in how it escapes binary data when using certain multi-byte character sets, allowing an attacker who can control binary parameter values to break out of the intended SQL string and execute arbitrary SQL commands. This could lead to unauthorized access to sensitive data or modification of database contents.
Technical details
The vulnerability is a multi-byte character set escape bypass in the connector's client-side parameter binding logic. When binding Buffer (binary) parameters, the connector escapes quote (0x27) and backslash (0x5C) bytes by inserting a backslash prefix. However, under multi-byte charsets where the trail-byte range includes 0x5C (big5, gbk, sjis, cp932, gb18030), an attacker-controlled lead byte followed by the escape backslash is interpreted by the server's SQL lexer as a single multi-byte character, consuming the escape backslash as the trail byte. This leaves the following quote unescaped, terminating the string literal and allowing SQL injection. The attack requires: (1) use of an affected charset (not the default utf8mb4), (2) untrusted data in a Buffer parameter, and (3) client-side parameter binding (not server-side prepared statements). Patches are available in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
Affected products
- MariaDB Connector/Node.js < 3.2.4, >= 3.3.0 and < 3.3.3, >= 3.4.0 and < 3.4.6, >= 3.5.0 and < 3.5.3
Timeline
- 2026-08-28: disclosed: GitHub Security Advisory GHSA-g5xc-5w98-jfvm published
- 2026-08-28: patched: Patches released in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3