SQL Injection in mysql

CRITICAL 9.8CVE-2015-9244 · GHSA-fvq6-55gv-jx9f · Published 29/05/2018 · updated 17/06/2026

In short

CVE-2015-9244 is a CRITICAL (CVSS 9.8) vulnerability affecting mysql (mysqljs), mysql.
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 84.3% of all vulnerabilities.
Fix: update to 2.0.0-alpha8 or later.

Package	Affected versions	Patched versions
mysql mysqljs	`= 2.0.0≤ 0.9.6`	No fix yet
mysql npm	`< 2.0.0-alpha8`	`2.0.0-alpha8`

Description

Versions of mysql prior to 2.0.0-alpha8 are affected by a SQL Injection vulnerability in the mysql.escape() function, which does not properly escape object keys.

Recommendation

Update to version 2.0.0-alpha8 or later.

NVD description

Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.

References

nvd.nist.gov/vuln/detail/CVE-2015-9244 · ADVISORY
felixge/node-mysql · WEB
npmjs.com/advisories/66 · WEB
nodesecurity.io/advisories/66 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free