{"uuid": "d4770fde-0ad8-4c8f-9d2c-5704d070ab17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55855", "type": "seen", "source": "https://gist.github.com/alon710/6f86711971bb7ed1944c7170d2f2eeef", "content": "# CVE-2026-55855: CVE-2026-55855: SQL Injection in MariaDB Connector/Node.js via Multi-byte Client Character Sets\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55855\n\n## Summary\nCVE-2026-55855 is a client-side SQL injection vulnerability in the MariaDB Connector/Node.js library that occurs when using legacy multi-byte character sets. The flaw arises from naive, byte-wise client-side parameter escaping. Attackers can leverage specific multi-byte lead bytes to absorb backslash escape characters on the server side, allowing them to terminate string literals and execute arbitrary SQL commands.\n\n## TL;DR\nA client-side escaping flaw in MariaDB's Node.js driver allows SQL injection when using legacy multi-byte encodings (e.g., GBK, BIG5). Upgrading or switching to utf8mb4 mitigates the issue.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-89 / CWE-116\n- **Attack Vector**: Network\n- **CVSS Severity**: 6.5 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Client-Side SQL Injection Bypass\n\n## Affected Systems\n\n- mariadb-connector-nodejs\n- **mariadb-connector-nodejs**: < 3.2.4 (Fixed in: `3.2.4`)\n- **mariadb-connector-nodejs**: >= 3.3.0, < 3.3.3 (Fixed in: `3.3.3`)\n- **mariadb-connector-nodejs**: >= 3.4.0, < 3.4.6 (Fixed in: `3.4.6`)\n- **mariadb-connector-nodejs**: >= 3.5.0, < 3.5.3 (Fixed in: `3.5.3`)\n\n## Mitigation\n\n- Upgrade the mariadb-connector-nodejs package to patched releases.\n- Enforce standard utf8mb4 encoding on the client connection.\n- Use server-side prepared statements via conn.execute() instead of text queries.\n\n**Remediation Steps:**\n1. Identify vulnerable installations by inspecting package-lock.json for the 'mariadb' dependency.\n2. Run 'npm install mariadb@latest' to resolve dependencies to versions 3.2.4, 3.3.3, 3.4.6, or 3.5.3 depending on the tracking branch.\n3. Modify database connection configurations to default to utf8mb4 rather than legacy encodings.\n4. Refactor usage of conn.query() to conn.execute() for parameterized database queries.\n\n## References\n\n- [Advisory GHSA-g5xc-5w98-jfvm](https://github.com/mariadb-corporation/mariadb-connector-nodejs/security/advisories/GHSA-g5xc-5w98-jfvm)\n- [Issue CONJS-350](https://jira.mariadb.org/browse/CONJS-350)\n- [CVE-2026-55855](https://www.cve.org/CVERecord?id=CVE-2026-55855)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55855) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-29T00:00:52.230101Z"}