MariaDB Connector/Node.js versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contain a SQL injection vulnerability due to improper escaping of special characters in text-protocol mode when the NO_BACKSLASH_ESCAPES SQL mode is enabled. This allows an attacker to inject arbitrary SQL commands by closing string literals improperly. The vulnerability does not affect execute() and batch() methods that use binary protocols. Fixed versions have been released to address this issue.
MariaDB Connector/Node.js versions from 3.2.0 up to but not including 3.2.5, 3.3.0 up to 3.3.4, 3.4.0 up to 3.4.7, and 3.5.0-rc.0 up to 3.5.4 contain a SQL injection vulnerability when the permitSetMultiParamEntries option is enabled. This flaw allows attacker-controlled keys with backticks to inject arbitrary SQL commands, potentially modifying unintended database columns and executing commands with the database user's privileges. The option is disabled by default, and serialized-object handling when disabled is not affected. The issue is fixed in versions 3.2.5, 3.3.4, 3.4.7, and 3.5.4.
MariaDB Connector/Node.js versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contain a vulnerability where malformed GeoJSON Polygon and MultiPolygon data can cause uninitialized Node.js heap memory to be disclosed in database values. This occurs because the connector allocates buffer space based on an unchecked numeric length before verifying the ring is an array, leading to potential exposure of sensitive information such as other users' data, session material, database credentials, or TLS key material. The issue is fixed in the specified versions.
A vulnerability in mariadb-connector-nodejs versions 3.3.0 up to but not including 3.5.4 causes an uncaught exception during zero-configuration TLS authentication using the client_ed25519 plugin. This results in a denial of service where the Node.js client process crashes and exits. The issue arises because the Ed25519PasswordAuth.hash() method references an undefined variable, causing a ReferenceError. No credentials or data are exposed, but availability is impacted. The flaw can be triggered by an attacker capable of intercepting the connection and presenting a self-signed certificate. The vulnerability is fixed in version 3.5.4. Workarounds include providing the server certificate to the client or using other authentication plugins.
CVE-2026-61700 is an improper access control vulnerability in MariaDB Connector/J affecting versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9. The flaw allows a rogue or man-in-the-middle server to cause the connector to transmit a local file despite the allowLocalInfile option being disabled, but only the exact file requested by the application can be sent. Exploitation requires an application that loads sensitive data over an untrusted connection. This issue has a CVSS score of 3.7 (medium severity) and is fixed in the specified versions.
MariaDB Connector/R2DBC versions prior to 1.4.1 do not prevent cleartext password authentication plugins from being used over unencrypted connections. This allows a malicious or man-in-the-middle MariaDB server to request cleartext password authentication over plain TCP, exposing user credentials in transit. The vulnerability is fixed in version 1.4.1.
MariaDB Connector/R2DBC versions prior to 1.4.1 improperly handle mid-session changes to the character_set_client encoding when it is changed from UTF-8 to another character set. This causes a mismatch between client and server character encoding, leading to silent data corruption and potential bypass of byte-wise quoting or escaping. The issue is fixed in version 1.4.1 by restricting accepted character sets to utf8, utf8mb3, or utf8mb4 after initialization, closing the connection otherwise.
MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 have a vulnerability where the connector incorrectly assumes the connection character set is UTF-8 throughout the session. If the server changes the character_set_client to a non-UTF-8 encoding mid-session, the driver continues to encode/decode as UTF-8, causing silent data corruption and charset confusion. This can defeat client-side escaping and quoting mechanisms. The issue is fixed by restricting allowed character sets after initialization to utf8, utf8mb3, or utf8mb4, with other values causing the connection to close with an error.
MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 have a vulnerability where PAM dialog authentication can transmit the account password in cleartext over insecure connections. This occurs because the PAM handler 'dialog' does not require secure transport, unlike the mysql_clear_password plugin. A malicious or man-in-the-middle server can exploit this by sending an Authentication Switch Request over plain TCP, causing the driver to expose the password if sslMode=DISABLE and restrictedAuth=null (default settings). The issue is fixed in the specified versions.
MariaDB Connector/J versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 contain a vulnerability where the initial handshake path does not properly enforce certificate fingerprint verification. This allows a man-in-the-middle or hostile server to present a self-signed certificate and receive the full database password via the mysql_clear_password authentication plugin before the connection is rejected.
MariaDB Connector/Node.js versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 contain a SQL injection vulnerability when using certain client character sets (big5, gbk, sjis, cp932, or gb18030). This occurs due to improper escaping of attacker-controlled Buffer parameters client-side, allowing an attacker to inject arbitrary SQL. The default utf8mb4 character set and prepared-statement execution paths are not affected. The vulnerability can lead to exposure or modification of data accessible to the database account. Fixed versions are available.
MariaDB Connector/Node.js versions prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3 can expose account passwords in cleartext during PAM dialog authentication over insecure transport. This occurs because the connector does not enforce secure transport for the PAM password authentication dialog, allowing a hostile or on-path server to trigger password disclosure over plain TCP. The issue is mitigated by using properly verified TLS or local Unix sockets. The vulnerability has a CVSS score of 5.9 (medium severity) and is fixed in the specified versions.
MariaDB Connector/Node.js versions prior to 3.3.3, 3.4.6, and 3.5.3 have an improper certificate validation vulnerability. When SSL is enabled without a pinned CA or server certificate, the connector may send credentials before completing certificate fingerprint validation. This allows a man-in-the-middle attacker to present a self-signed certificate, capture the database password, and authenticate directly even though the connection is later closed. The issue is fixed in versions 3.3.3, 3.4.6, and 3.5.3.