« Volver al listado

CVE-2026-107384

Estado: Pendiente de análisisAlta (8.1)—

MariaDB Connector/Node.js se utiliza para conectar aplicaciones desarrolladas en Node.js a bases de datos MariaDB y MySQL. Desde la 3.2.0 hasta la 3.2.5, 3.3.4, 3.4.7 y 3.5.4, las aplicaciones que habilitan permitSetMultiParamEntries pueden pasar objetos cuyas claves se expanden en una cláusula SQL SET sin ser procesadas por escapeId. Una clave controlada por el atacante que contenga una comilla invertida puede cerrar el identificador entrecomillado y hacer que el resto de la clave se interprete como SQL.

Leer descripción completaMostrar menos

Esto puede actualizar columnas que la aplicación no pretendía exponer y puede añadir SQL arbitrario con los privilegios del usuario de la base de datos. La opción está deshabilitada de forma predeterminada, y la gestión de objetos serializados utilizada cuando está deshabilitada no está afectada. Este problema está corregido en las versiones 3.2.5, 3.3.4, 3.4.7 y 3.5.4.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

SQL injection en MariaDB Connector/Node.js (CWE-89) via backtick en clave de parámetro cuando permitSetMultiParamEntries está habilitado. AV:N/AC:H permite T1190. Impactos: manipulación de datos en columnas no autorizadas (T1565.001) y lectura de datos con privilegios de base de datos (T1005).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork SegmentationLimit Access to Resource Over Network

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Mariadb — Mariadb Connector NodejsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-107384",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107384",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-09T18:36:16.374199Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "mariadb-corporation",
          "product": "mariadb-connector-nodejs",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.2.0, < 3.2.5"
            },
            {
              "status": "affected",
              "version": ">= 3.3.0, < 3.3.4"
            },
            {
              "status": "affected",
              "version": ">= 3.4.0, < 3.4.7"
            },
            {
              "status": "affected",
              "version": ">= 3.5.0-rc.0, < 3.5.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-08T19:17:00.990",
  "references": [
    {
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/144b8f4ef29539a9fb4b75d972b9dcdac4088b4e",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6743b2f4a89b074268b44c650170767f35e1fb5d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/8eb450972ff0f3826d7d45c071a42240798bc826",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b9b04ec82a60b2caf2b0c038259ca9aff5d7014a",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-v6pj-gxxw-phfw",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://hackerone.com/reports/3889198",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://jira.mariadb.org/browse/CONJS-369",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processed by escapeId. An attacker-controlled key containing a backtick can close the quoted identifier and cause the remainder of the key to be interpreted as SQL. This can update columns the application did not intend to expose and can append arbitrary SQL with the database user's privileges. The option is disabled by default, and serialized-object handling used when it is disabled is not affected. This issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4."
    }
  ],
  "lastModified": "2026-10-09T19:16:41.390",
  "sourceIdentifier": "security-advisories@github.com"
}