mysql-import
mysql-import copied to clipboard
Bump mysql2 reference
Describe the bug Version 5.0.26 depends on vulnerable version of mysql2. The dependency should be updated to latest version of mysql2.
Code To Reproduce npm audit report shown below
# npm audit report
mysql2 <=3.9.7
Severity: critical
mysql2 Remote Code Execution (RCE) via the readCodeFor function - https://github.com/advisories/GHSA-fpw7-j2hg-69v5
mysql2 vulnerable to Prototype Poisoning - https://github.com/advisories/GHSA-49j4-86m8-q2jw
mysql2 cache poisoning vulnerability - https://github.com/advisories/GHSA-mqr2-w7wj-jjgr
MySQL2 for Node Arbitrary Code Injection - https://github.com/advisories/GHSA-4rch-2fh8-94vw
mysql2 vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-pmh2-wpjm-fj45
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/mysql-import/node_modules/mysql2
mysql-import >=5.0.26
Depends on vulnerable versions of mysql2
node_modules/mysql-import