GHSA-f982-mxwc-3mrx

Suggest an improvement
Source
https://github.com/advisories/GHSA-f982-mxwc-3mrx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f982-mxwc-3mrx/GHSA-f982-mxwc-3mrx.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-f982-mxwc-3mrx
Aliases
Published
2022-05-24T16:53:05Z
Modified
2023-11-01T04:50:30.238272Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
MySQL for Node.js Unsafe Options
Details

An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default.

Database specific 
{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-200"
    ],
    "severity": "MODERATE",
    "nvd_published_at": "2019-08-12T01:15:00Z",
    "github_reviewed_at": "2023-07-17T18:54:11Z"
}
References

Affected packages

npm / mysql

Package

Name
mysql
View open source insights on deps.dev
Purl
pkg:npm/mysql

Affected ranges

Type
SEMVER
Events
Introduced
2.17.1
Fixed
2.18.0

Affected versions

2.*
2.17.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f982-mxwc-3mrx/GHSA-f982-mxwc-3mrx.json"