{"action":"Upgrade mysql2 to 3.9.4 or later.","affected":[{"fixed":"3.9.4","introduced":"0"}],"component":"mysql2","cve_ids":["CVE-2024-21508"],"ecosystem":"npm","epss":0.02554,"exploited":false,"fixed_versions":["3.9.4"],"ghsa_id":"GHSA-fpw7-j2hg-69v5","id":"tcs_01M5KFNYSKEXJDJGQ7732S4JZW","modified_at":"2026-09-10T03:50:11.212637363Z","published_at":"2024-04-11T06:30:35Z","references":["https://osv.dev/vulnerability/GHSA-fpw7-j2hg-69v5","https://nvd.nist.gov/vuln/detail/CVE-2024-21508","https://github.com/sidorares/node-mysql2/pull/2572","https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805","https://blog.slonser.info/posts/mysql2-attacker-configuration","https://github.com/sidorares/node-mysql2","https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21","https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4","https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-fpw7-j2hg-69v5","url":"https://osv.dev/vulnerability/GHSA-fpw7-j2hg-69v5"}],"summary":"mysql2 Remote Code Execution (RCE) via the readCodeFor function"}