{"action":"Upgrade mariadb to 3.2.5 or later.","affected":[{"fixed":"3.2.5","introduced":"3.2.0"},{"fixed":"3.3.4","introduced":"3.3.0"},{"fixed":"3.4.7","introduced":"3.4.0"},{"fixed":"3.5.4","introduced":"3.5.0-rc.0"}],"component":"mariadb","cve_ids":["CVE-2026-107384"],"ecosystem":"npm","epss":0.00447,"exploited":false,"fixed_versions":["3.2.5","3.3.4","3.4.7","3.5.4"],"ghsa_id":"GHSA-v6pj-gxxw-phfw","id":"tcs_01M5JHH5DYE0412F74VMR3RASJ","modified_at":"2026-10-16T09:55:54.224043608Z","published_at":"2026-10-08T19:42:23Z","references":["https://osv.dev/vulnerability/GHSA-v6pj-gxxw-phfw","https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-v6pj-gxxw-phfw","https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/144b8f4ef29539a9fb4b75d972b9dcdac4088b4e","https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/6743b2f4a89b074268b44c650170767f35e1fb5d","https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/8eb450972ff0f3826d7d45c071a42240798bc826","https://github.com/mariadb-corporation/mariadb-connector-nodejs/commit/b9b04ec82a60b2caf2b0c038259ca9aff5d7014a","https://hackerone.com/reports/3889198","https://github.com/mariadb-corporation/mariadb-connector-nodejs","https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.2.5","https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.3.4","https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.4.7","https://github.com/mariadb-corporation/mariadb-connector-nodejs/releases/tag/3.5.4","https://jira.mariadb.org/browse/CONJS-369"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-v6pj-gxxw-phfw","url":"https://osv.dev/vulnerability/GHSA-v6pj-gxxw-phfw"}],"summary":"MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)"}