CVE-2019-14939: MySQL for Node.js Unsafe Options
Summary
CVE-2019-14939: MySQL for Node.js Unsafe Options. Affects mysql versions >= 2.17.1, < 2.18.0. Fixed in 2.18.0. How to fix ↓
Also tracked for
- node-mysql · Debian:11
The same CVE-2019-14939 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mysql (aka mysqljs) module 2.17.1 for Node.js is a popular package used for connecting to MySQL databases. It provides a convenient way to interact with MySQL servers and execute queries. However, this module is vulnerable to an issue where the LOAD DATA LOCAL INFILE option is open by default.
Vulnerability Detail
The vulnerability in the mysql module arises from the fact that the LOAD DATA LOCAL INFILE option is enabled by default. This option allows the execution of arbitrary local files on the server, which can lead to unauthorized access or data manipulation. An attacker can exploit this vulnerability by crafting a malicious query that includes a file path to be loaded. If the application using the mysql module does not properly validate and sanitize user input, an attacker can execute arbitrary code or access sensitive data on the server.
How To Fix
Latest published version: 2.18.1 as of 22 Oct 2026
npm install mysql@2.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.18.0
This is the first release that contains the fix.
npm install mysql@2.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of the mysql module is not immediately feasible, a workaround is to explicitly disable the LOAD DATA LOCAL INFILE option in the application's database connection configuration. This can be done by setting the localInfile option to false when creating the connection. For example:
const mysql = require('mysql');
const connection = mysql.createConnection({
host: 'localhost',
user: 'username',
password: 'password',
database: 'database',
localInfile: false
});
Conclusion
In conclusion, the mysql module for Node.js versions prior to 2.18.0 is vulnerable to an issue where the LOAD DATA LOCAL INFILE option is open by default. This can lead to unauthorized access, data manipulation, or even a complete compromise of the affected system. It is recommended to upgrade to the latest version of the mysql module and ensure proper input validation and sanitization to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for mysql →
FAQ
This vulnerability allows an attacker to execute arbitrary code or access sensitive data on the server. It can lead to unauthorized access, data manipulation, or even a complete compromise of the affected system.
To determine if your application is affected, you can use the Vulert Playground at Vulert Scanner. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
To upgrade the mysql module to the latest version, you can use the package manager for your Node.js project. For example, if you are using npm, you can run the command npm install mysql@latest to install the latest version of the module.
While there are no known public exploits specifically targeting this vulnerability, it is important to address it promptly to prevent any potential attacks. Keeping your dependencies up to date and following secure coding practices can help mitigate the risk.
You can find more information about this vulnerability, including the technical details and the fix, in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f982-mxwc-3mrx/GHSA-f982-mxwc-3mrx.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for mysql.
