SQL Injection in mysql

KRITISCH 9.8CVE-2015-9244 · GHSA-fvq6-55gv-jx9f · Published 29/05/2018 · updated 17/06/2026

Kurz gesagt

CVE-2015-9244 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in mysql (mysqljs), mysql.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.4%, höher als bei 84.3% aller Schwachstellen.
Abhilfe: auf 2.0.0-alpha8 oder neuer aktualisieren.

Package	Affected versions	Patched versions
mysql mysqljs	`= 2.0.0≤ 0.9.6`	No fix yet
mysql npm	`< 2.0.0-alpha8`	`2.0.0-alpha8`

Description

Versions of mysql prior to 2.0.0-alpha8 are affected by a SQL Injection vulnerability in the mysql.escape() function, which does not properly escape object keys.

Recommendation

Update to version 2.0.0-alpha8 or later.

NVD description

Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.

References

nvd.nist.gov/vuln/detail/CVE-2015-9244 · ADVISORY
felixge/node-mysql · WEB
npmjs.com/advisories/66 · WEB
nodesecurity.io/advisories/66 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free