MEDIUM5.5
GHSA-f982-mxwc-3mrx
MySQL for Node.js Unsafe Options
Quick fix
GHSA-f982-mxwc-3mrx — mysql: upgrade to the fixed version with the command below.
npm install mysql@2.18.0Details
An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. `The LOAD DATA LOCAL INFILE` option is open by default.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-14939[ADVISORY]
- https://github.com/mysqljs/mysql/issues/2471[WEB]
- https://github.com/mysqljs/mysql/commit/337e87ae5fcea3667864197c65dc758517fcde06[WEB]
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934712>[WEB]
- https://github.com/mysqljs/mysql[PACKAGE]
- https://web.archive.org/web/20190812004403/https://github.com/mysqljs/mysql/issues/2257[WEB]