CVE-2024-21512: 
JavaScript vulnerability analysis and mitigation

CVE-2024-21512 affects mysql2 package versions before 3.9.8. The vulnerability was discovered on May 16, 2024, and disclosed on May 28, 2024. This security flaw is a Prototype Pollution vulnerability that occurs due to improper user input sanitization when handling fields and tables with the nestTables feature (Snyk JS).

The vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) and has been assigned a CVSS v3.1 score of 8.2 (High). The security flaw specifically manifests when using the nestTables feature, where improper sanitization of user input passed to fields and tables can lead to prototype pollution attacks. The vulnerability allows attackers to manipulate JavaScript object prototype attributes (NVD, Snyk JS).

The vulnerability can lead to multiple severe consequences including denial of service through JavaScript exceptions, tampering with application source code, and potential remote code execution. The high CVSS score indicates significant potential impact on system integrity and availability (Snyk JS).

The vulnerability is remotely exploitable without requiring authentication or user interaction. A proof-of-concept exploit has been publicly disclosed demonstrating how an attacker can manipulate object prototypes through SQL queries using the nestTables feature (Security Online, GitHub Gist).

The vulnerability has been patched in mysql2 version 3.9.8. Users are strongly recommended to upgrade to this version or later. The fix includes improved sanitization of fields and tables when using nestTables functionality (GitHub PR).

The vulnerability has garnered significant attention in the security community due to mysql2's widespread usage, with over 2 million monthly downloads. The security community reacted swiftly to the disclosure, with proof-of-concept code being shared and analyzed (Security Online).