mariadb
fast mariadb or mysql connector.
88%
Total Score
83
100
100
67
50
Health Score Breakdown
No build attestation or trusted-publisher provenance is present, which limits publication transparency, but this is a moderate gap rather than evidence of abandonment.
One contributor made 43 of 45 recent commits, or about 96%, creating a meaningful concentration risk. The organization-owned repository provides some handoff capacity, but the observed activity remains highly dependent on one contributor.
The repository has no published security policy, leaving vulnerability-reporting expectations unclear despite its CodeQL scanning.
Both workflows were analyzed without failed files or dangerous-trigger sinks, and one scopes permissions at job level. However, all 13 analyzed action references are unpinned, weakening build reproducibility and action supply-chain control.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2026-107385 New mariadb is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in versions 0.0.0 - 3.2.5, 3.3.0 - 3.3.4, 3.4.0 - 3.4.7 and 3.5.0-rc.0 - 3.5.4. | 0.0.0 - 3.2.53.3.0 - 3.3.43.4.0 - 3.4.7 +1 more | High |
CVE-2026-107384 New mariadb is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in versions 3.2.0 - 3.2.5, 3.3.0 - 3.3.4, 3.4.0 - 3.4.7 and 3.5.0-rc.0 - 3.5.4. | 3.2.0 - 3.2.53.3.0 - 3.3.43.4.0 - 3.4.7 +1 more | High |
CVE-2026-107383 New mariadb is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.0.0 - 3.2.5, 3.3.0 - 3.3.4, 3.4.0 - 3.4.7 and 3.5.0-rc.0 - 3.5.4. | 0.0.0 - 3.2.53.3.0 - 3.3.43.4.0 - 3.4.7 +1 more | High |
CVE-2026-107382 New mariadb is vulnerable to Uncaught Exception in versions 3.3.0 - 3.5.4. | 3.3.0 - 3.5.4 | Medium |
CVE-2026-55855 mariadb is vulnerable to Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in versions 0.0.0 - 3.2.4, 3.3.0 - 3.3.3, 3.4.0 - 3.4.6 and 3.5.0 - 3.5.3. | 0.0.0 - 3.2.43.3.0 - 3.3.33.4.0 - 3.4.6 +1 more | Medium |
Package versions
Maintainers
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 denque Version ^2.1.0 | — | — |
lru-cache Version ^11.5.0 | — | — |
iconv-lite Version ^0.7.2 | — | — |
@types/node Version >=20 | — | — |
@types/geojson Version ^7946.0.16 | — | — |
Weekly Downloads
Info
- Last Published
- 1 month ago
- Created
- 9 years ago
- Unpacked Size
- 1.4 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.