CVE-2026-55855: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in mariadb-corporation mariadb-connector-nodejs

MariaDB Connector/Node.js improperly neutralizes special elements used in SQL commands when escaping Buffer parameters under specific multibyte character sets (big5, gbk, sjis, cp932, gb18030). The escaping function PacketOutputStream.writeBufferEscape does not use charset-aware logic, causing backslash escapes to be bypassed by the server's SQL lexer due to multibyte character interpretation. This allows an attacker to terminate string literals and inject arbitrary SQL commands. The vulnerability affects versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 and is fixed in those versions. The default utf8mb4 charset and prepared-statement binary execution are not vulnerable.

Successful exploitation can lead to unauthorized exposure or modification of data accessible to the database account used by the application. The vulnerability does not affect availability and requires network access with high attack complexity and no privileges or user interaction. The CVSS score is 6.5 (medium severity).

Upgrade MariaDB Connector/Node.js to version 3.2.4, 3.3.3, 3.4.6, or 3.5.3 or later, where this SQL injection vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is confirmed by the vendor advisory stating fixed versions.