Sidorares Mysql2 vulnerabilities

CVE-2024-21508 [CRITICAL] CWE-94 mysql2 Remote Code Execution (RCE) via the readCodeFor function mysql2 Remote Code Execution (RCE) via the readCodeFor function Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the `readCodeFor` function due to improper validation of the `supportBigNumbers` and `bigNumberStrings` values.

CVE-2024-21511 [CRITICAL] CWE-94 MySQL2 for Node Arbitrary Code Injection MySQL2 for Node Arbitrary Code Injection Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

CVE-2024-21512 [HIGH] CWE-1321 mysql2 vulnerable to Prototype Pollution mysql2 vulnerable to Prototype Pollution Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.

CVE-2024-21509 [MEDIUM] CWE-1321 CVE-2024-21509: Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure re Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

CVE-2024-21507 [MEDIUM] CWE-20 CVE-2024-21507: Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.