Server side template injection In mysql2
Description
MySQL2 for Node Arbitrary Code Injection Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 npm | 3.9.7 |
Aliases
1. 2. 3. 4.
References
1. 2. 3.