-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mysql2 | npm | < 3.9.7 | 3.9.7 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper sanitization when constructing date/time parsing code strings. Both parser implementations directly embedded user-controlled 'timezone' parameters into generated JavaScript code using string interpolation without proper escaping. This allowed attackers to inject Node.js code through specially crafted timezone values. The fix introduced helpers.srcEscape() to sanitize these inputs, and the added test cases specifically target timezone parameter injection scenarios in both binary and text parsers.
Ongoing coverage of React2Shell