Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-u9gj-xfsc-6fhb
Vulnerability ID VCID-u9gj-xfsc-6fhb
Aliases CVE-2024-21508
GHSA-fpw7-j2hg-69v5
Summary Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21508.json
epss 0.46188 https://api.first.org/data/v1/epss?cve=CVE-2024-21508
epss 0.46188 https://api.first.org/data/v1/epss?cve=CVE-2024-21508
cvssv3.1 9.8 https://blog.slonser.info/posts/mysql2-attacker-configuration
generic_textual CRITICAL https://blog.slonser.info/posts/mysql2-attacker-configuration
cvssv3.1 9.8 https://blog.slonser.info/posts/mysql2-attacker-configuration/
ssvc Track https://blog.slonser.info/posts/mysql2-attacker-configuration/
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-fpw7-j2hg-69v5
cvssv3.1 9.8 https://github.com/sidorares/node-mysql2
generic_textual CRITICAL https://github.com/sidorares/node-mysql2
cvssv3.1 9.8 https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21
cvssv3.1 9.8 https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21
generic_textual CRITICAL https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21
ssvc Track https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21
cvssv3.1 9.8 https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
cvssv3.1 9.8 https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
generic_textual CRITICAL https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
ssvc Track https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
cvssv3.1 9.8 https://github.com/sidorares/node-mysql2/pull/2572
cvssv3.1 9.8 https://github.com/sidorares/node-mysql2/pull/2572
generic_textual CRITICAL https://github.com/sidorares/node-mysql2/pull/2572
ssvc Track https://github.com/sidorares/node-mysql2/pull/2572
cvssv3.1 9.8 https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
cvssv3.1 9.8 https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
generic_textual CRITICAL https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
ssvc Track https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2024-21508
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2024-21508
cvssv3.1 9.8 https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085
cvssv3.1 9.8 https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085
generic_textual CRITICAL https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085
ssvc Track https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21508.json
https://api.first.org/data/v1/epss?cve=CVE-2024-21508
https://blog.slonser.info/posts/mysql2-attacker-configuration
https://github.com/sidorares/node-mysql2
2274446 https://bugzilla.redhat.com/show_bug.cgi?id=2274446
2572 https://github.com/sidorares/node-mysql2/pull/2572
74abf9ef94d76114d9a09415e28b496522a94805 https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
CVE-2024-21508 https://nvd.nist.gov/vuln/detail/CVE-2024-21508
GHSA-fpw7-j2hg-69v5 https://github.com/advisories/GHSA-fpw7-j2hg-69v5
mysql2-attacker-configuration https://blog.slonser.info/posts/mysql2-attacker-configuration/
SNYK-JS-MYSQL2-6591085 https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085
text_parser.js%23L14C10-L14C21 https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21
v3.9.4 https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-21508.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://blog.slonser.info/posts/mysql2-attacker-configuration
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://blog.slonser.info/posts/mysql2-attacker-configuration/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-04-11T13:05:22Z/ Found at https://blog.slonser.info/posts/mysql2-attacker-configuration/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/sidorares/node-mysql2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-04-11T13:05:22Z/ Found at https://github.com/sidorares/node-mysql2/blob/1609b5393516d72a4ae47196837317fbe75e0c13/lib/parsers/text_parser.js%23L14C10-L14C21
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-04-11T13:05:22Z/ Found at https://github.com/sidorares/node-mysql2/commit/74abf9ef94d76114d9a09415e28b496522a94805
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://github.com/sidorares/node-mysql2/pull/2572
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/sidorares/node-mysql2/pull/2572
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-04-11T13:05:22Z/ Found at https://github.com/sidorares/node-mysql2/pull/2572
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-04-11T13:05:22Z/ Found at https://github.com/sidorares/node-mysql2/releases/tag/v3.9.4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-21508
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P Found at https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-04-11T13:05:22Z/ Found at https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085
Exploit Prediction Scoring System (EPSS)
Percentile 0.97722
EPSS Score 0.46188
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:38:48.245372+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/21xxx/CVE-2024-21508.json 38.6.0