{"vulnerability": "cve-2024-21508", "sightings": [{"uuid": "3d762664-4640-4e09-b2f6-e7ba9f5cb0c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21508", "type": "seen", "source": "https://t.me/arpsyndicate/4651", "content": "#ExploitObserverAlert\n\nCVE-2024-21508\n\nDESCRIPTION: Exploit Observer has 9 entries in 3 file formats related to CVE-2024-21508. Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.\n\nFIRST-EPSS: 0.000440000\nARPS-EXPLOITABILITY: 0.7512425", "creation_timestamp": "2024-04-13T12:40:50.000000Z"}, {"uuid": "01585bc2-e78c-43f4-86ae-731553593af1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21508", "type": "seen", "source": "https://t.me/arpsyndicate/4613", "content": "#ExploitObserverAlert\n\nCVE-2024-21508\n\nDESCRIPTION: Exploit Observer has 3 entries in 1 file formats related to CVE-2024-21508. Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.\n\nFIRST-EPSS: 0.000440000\nARPS-EXPLOITABILITY: 0.6373563", "creation_timestamp": "2024-04-13T00:42:42.000000Z"}, {"uuid": "1e1eb8b1-1bc8-4f81-aa3c-e62e9e7c724f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-21508", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvar5wrzci2f", "content": "CVE-2024-21508 - mysql2\nThe mysql2 code library used in Node.js applications can be tricked into running malicious commands. This could let an attacker take control of the system that uses the library.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#mysql2 #rootio #npm #CVE #infosec", "creation_timestamp": "2026-09-11T14:20:04.510687Z"}]}