CVE-2026-55855: 
MariaDB Server vulnerability analysis and mitigation

CVE-2026-55855 is a SQL injection vulnerability in MariaDB Connector/Node.js affecting the client-side Buffer parameter escaping logic when using multi-byte character sets. Specifically, the PacketOutputStream.writeBufferEscape function in lib/io/packet-output-stream.js performed charset-unaware byte-wise escaping, allowing an attacker-controlled lead byte to absorb the inserted backslash (0x5C) escape character as a multi-byte trail byte, leaving the following quote (0x27) unescaped and enabling arbitrary SQL injection. Affected versions include all releases before 3.2.4, 3.3.0–3.3.2, 3.4.0–3.4.5, and 3.5.0–3.5.2. The vulnerability was reported by Yalguun Tumenkhuu (@fg0x0), published on August 28, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is improper encoding/escaping of output (CWE-116) leading to SQL injection (CWE-89). The vulnerable code path is PacketOutputStream.writeBufferEscape in lib/io/packet-output-stream.js, which escaped Buffer parameters byte-by-byte without invoking the charset-aware getMbRecognizer logic from lib/misc/charset-mb.js. Under the affected client character sets — big5, gbk, sjis, cp932, and gb18030 — the trail-byte range of valid multi-byte characters overlaps with the ASCII backslash (0x5C). The MariaDB server SQL lexer runs my_ismbchar (multi-byte character recognition) before escape processing, so when the connector inserts a 0x5C escape before a 0x27 quote, the server lexer can consume the 0x5C as the trail byte of a multi-byte character, leaving the 0x27 bare and able to terminate the string literal. This is the same class of multi-byte escaping bypass historically affecting addslashes/mysql_real_escape_string under GBK/Big5. The attack requires network access, no privileges, and no user interaction, but has high complexity since the connection must be configured with one of the affected non-default character sets and untrusted data must reach a Buffer-typed query parameter (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to break out of an intended SQL string literal and inject arbitrary SQL commands, leading to unauthorized read or modification of data accessible to the database account. The confidentiality impact is high (full data exposure within the database account's scope), integrity impact is low (data modification possible), and there is no direct availability impact. Depending on the database account's privileges, further compromise such as privilege escalation within the database, data exfiltration, or data manipulation is possible (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a non-default client character set configuration (big5, gbk, sjis, cp932, or gb18030) and the ability to supply attacker-controlled data as a Buffer parameter — conditions that limit the practical attack surface. No threat actor attribution has been identified (GitHub Advisory, Feedly).

1. Identify a vulnerable target: Locate a Node.js application using the mariadb npm package at a version below 3.2.4, 3.3.3, 3.4.6, or 3.5.3, where the database connection is configured with charset set to big5, gbk, sjis, cp932, or gb18030 (non-default).
2. Identify an injectable Buffer parameter: Find an application code path where attacker-controlled data is passed as a Buffer object to a query using the text/query protocol (not the binary prepared-statement execute path).
3. Craft the attack payload: Construct a Buffer containing a valid multi-byte lead byte (e.g., 0xA1 for big5/gbk) followed by a single quote (0x27) and the desired SQL payload (e.g., Buffer.from([0xa1, 0x27, 0x20, 0x4f, 0x52, 0x20, 0x31, 0x3d, 0x31]) — representing \xA1' OR 1=1).
4. Trigger the injection: Submit the crafted input through the application's interface so it reaches the vulnerable query parameter. The connector inserts 0x5C before 0x27, producing the wire sequence [0xA1, 0x5C, 0x27, ...]. The server lexer consumes 0xA1 0x5C as a valid multi-byte character, leaving 0x27 as a bare quote that closes the string literal.
5. Execute arbitrary SQL: The remaining bytes after the unescaped quote are parsed as SQL, allowing the attacker to append arbitrary SQL clauses (e.g., OR 1=1, UNION SELECT, DROP TABLE) to exfiltrate or modify data (GitHub Advisory, Fix Commit).

• Logs: Database query logs showing unexpected SQL syntax such as unbalanced quotes, OR 1=1, UNION SELECT, or other SQL injection patterns in queries that include binary/Buffer data; application error logs showing SQL parse errors or unexpected query results.
• Network: Unusual or malformed SQL queries transmitted from the Node.js application to the MariaDB/MySQL server, particularly in connections using big5, gbk, sjis, cp932, or gb18030 character sets.
• Application Behavior: Unexpected data returned from database queries (e.g., all rows returned when only one is expected); unauthorized data modifications or deletions in the database; anomalous database account activity inconsistent with normal application behavior.

Upgrade the mariadb npm package to a patched version: 3.5.3 (for 3.5.x), 3.4.6 (for 3.4.x), 3.3.3 (for 3.3.x), or 3.2.4 (for 3.2.x and earlier). The fix introduces a new writeBufferEscapeMb method and a charset-mb.js module with per-charset multi-byte recognizers, ensuring Buffer escaping is charset-aware for the affected encodings. If an immediate upgrade is not possible, two workarounds are available: (1) use server-side prepared statements via the execute API so parameters are sent via the binary protocol and never escaped into SQL text; or (2) avoid passing untrusted data as Buffer parameters when the connection uses one of the affected character sets. Applications using the default utf8mb4 charset are not affected (GitHub Advisory).