CVE-2024-21511

—

CVSS 3.1

9.8 critical

EPSS

1%p62

Published

Apr 23, 2024 (Apr 23, 2024)

Modified

Jun 17, 2026

Description

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

Weakness: CWE-94
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.