Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-sgrh-4nnj-vqcj
Vulnerability ID VCID-sgrh-4nnj-vqcj
Aliases CVE-2024-21512
GHSA-pmh2-wpjm-fj45
Summary Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21512.json
epss 0.68341 https://api.first.org/data/v1/epss?cve=CVE-2024-21512
epss 0.68341 https://api.first.org/data/v1/epss?cve=CVE-2024-21512
epss 0.68341 https://api.first.org/data/v1/epss?cve=CVE-2024-21512
cvssv3.1 8.2 https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
cvssv3.1 8.2 https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
generic_textual HIGH https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
ssvc Track https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-pmh2-wpjm-fj45
cvssv3.1 8.2 https://github.com/sidorares/node-mysql2
generic_textual HIGH https://github.com/sidorares/node-mysql2
cvssv3.1 8.2 https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
cvssv3.1 8.2 https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
generic_textual HIGH https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
ssvc Track https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
cvssv3.1 8.2 https://github.com/sidorares/node-mysql2/pull/2702
cvssv3.1 8.2 https://github.com/sidorares/node-mysql2/pull/2702
generic_textual HIGH https://github.com/sidorares/node-mysql2/pull/2702
ssvc Track https://github.com/sidorares/node-mysql2/pull/2702
cvssv3.1 8.2 https://nvd.nist.gov/vuln/detail/CVE-2024-21512
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-21512
cvssv3.1 8.2 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
cvssv3.1 8.2 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
generic_textual HIGH https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
ssvc Track https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
cvssv3.1 8.2 https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
cvssv3.1 8.2 https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
generic_textual HIGH https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
ssvc Track https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21512.json
https://api.first.org/data/v1/epss?cve=CVE-2024-21512
https://github.com/sidorares/node-mysql2
2283737 https://bugzilla.redhat.com/show_bug.cgi?id=2283737
2702 https://github.com/sidorares/node-mysql2/pull/2702
CVE-2024-21512 https://nvd.nist.gov/vuln/detail/CVE-2024-21512
e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
efe3db527a2c94a63c2d14045baba8dfefe922bc https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
GHSA-pmh2-wpjm-fj45 https://github.com/advisories/GHSA-pmh2-wpjm-fj45
SNYK-JAVA-ORGWEBJARSNPM-7176010 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
SNYK-JS-MYSQL2-6861580 https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21512.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Found at https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P Found at https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-05-29T14:07:58Z/ Found at https://gist.github.com/domdomi3/e9f0f9b9b1ed6bfbbc0bea87c5ca1e4a
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/sidorares/node-mysql2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P Found at https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-05-29T14:07:58Z/ Found at https://github.com/sidorares/node-mysql2/commit/efe3db527a2c94a63c2d14045baba8dfefe922bc
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Found at https://github.com/sidorares/node-mysql2/pull/2702
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P Found at https://github.com/sidorares/node-mysql2/pull/2702
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-05-29T14:07:58Z/ Found at https://github.com/sidorares/node-mysql2/pull/2702
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2024-21512
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-05-29T14:07:58Z/ Found at https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-7176010
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P Found at https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L Found at https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2024-05-29T14:07:58Z/ Found at https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6861580
Exploit Prediction Scoring System (EPSS)
Percentile 0.98627
EPSS Score 0.68341
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:38:46.452986+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/21xxx/CVE-2024-21512.json 38.6.0