CVE-2026-55855— MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
Quick assessment
Affected
mariadb-corporation mariadb-connector-nodejs
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MariaDB Connector/Node.js 用于将基于 Node.js 开发的应用程序连接到 MariaDB 和 MySQL 数据库。在版本 3.2.4、3.3.3、3.4.6 和 3.5.3 之前，当使用 big5、gbk、sjis、cp932 或 gb18030 客户端字符集时，MariaDB Connector/Node.js 允许通过客户端端转义攻击者可控的 Buffer 参数来触发 SQL 注入漏洞。 具体而言， 中的 在转义字节时，未应用 中基于字符集的多字节识别逻辑（ ）。由于服务器端的 SQ
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55855
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MariaDB Connector/Node.js: Possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets
Source: CVE Program / CVE List V5
Vulnerability Description
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 client character sets. PacketOutputStream.writeBufferEscape in lib/io/packet-output-stream.js escaped bytes without the charset-aware getMbRecognizer logic in lib/misc/charset-mb.js. The server SQL lexer runs my_ismbchar before escape processing, so an attacker-controlled lead byte can consume the inserted 0x5C backslash as a multibyte trail byte and leave the following 0x27 quote unescaped, terminating the string literal and allowing arbitrary SQL. The default utf8mb4 character set and parameters sent through the execute binary prepared-statement path are not affected. Successful exploitation can expose or modify data available to the database account. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| mariadb-corporation | mariadb-connector-nodejs | < 3.2.4 | - |
|
II. Public POCs for CVE-2026-55855
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55855
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55855 (4)
Vendor Advisories for CVE-2026-55855 (1)
Vendor Pages for CVE-2026-55855 (5)
Same Patch Batch · mariadb-corporation · 2026-08-28 · 8 CVEs total
| CVE-2026-55215 | 7.5 HIGH | MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: |
| CVE-2026-55854 | 5.9 MEDIUM | MariaDB Connector/Node.js: Cleartext Transmission of Sensitive Information and Insufficien |
| CVE-2026-55856 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext password disclosure to a MITM on the initial-handshake |
| CVE-2026-55860 | 5.9 MEDIUM | MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clea |
| CVE-2026-55859 | 5.9 MEDIUM | MariaDB Connector/R2DBC: Inappropriate Encoding for Output Context and Improper Encoding o |
| CVE-2026-55857 | 5.9 MEDIUM | MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Pr |
| CVE-2026-55858 | 5.9 MEDIUM | MariaDB Connector/J: Inappropriate Encoding for Output Context in org.mariadb.jdbc:mariadb |
IV. Related Vulnerabilities
Same vendor: mariadb-corporation
-
CVE-2026-55860
MariaDB Connector/R2DBC: Cleartext password disclosure to a -
CVE-2026-55859
MariaDB Connector/R2DBC: Inappropriate Encoding for Output C -
CVE-2026-55858
MariaDB Connector/J: Inappropriate Encoding for Output Conte -
CVE-2026-55857
MariaDB Connector/J: Cleartext Transmission of Sensitive Inf -
CVE-2026-55856
MariaDB Connector/J: Cleartext password disclosure to a MITM
Same weakness: CWE-89
-
CVE-2026-77586
MongoDB Connector for BI Unescaped Object Names in Generated -
CVE-2026-77184
MongoDB Connector for BI Incomplete Escaping of Stored Metad -
CVE-2026-55634
Pimcore: Remote Code Execution via DataObject Class-Definiti -
CVE-2026-55509
WsgiDAV: Blind SQL injection in the MySQL provider -
CVE-2026-82227
WordPress WPBulky plugin <= 1.2.2 - SQL Injection vulnerabil
V. Comments for CVE-2026-55855
No comments yet