AIKIDO-2026-296083

TL;DR

The connector escapes Buffer query parameters with a byte-wise routine that inserts a backslash before quote and backslash bytes without accounting for multi-byte client charsets. When the connection uses a big5, gbk, sjis, cp932, or gb18030 charset, a crafted multi-byte sequence can absorb the inserted backslash so an attacker-influenced buffer breaks out of the surrounding string literal and injects arbitrary SQL. An attacker who controls the content of a buffer parameter can alter query structure and read or modify data beyond the intended statement. The fix adds charset-aware escaping that keeps valid multi-byte characters intact and escapes lone lead bytes so they cannot combine with following bytes on the wire.