GitHub Advisoryadvisory · npm

GHSA-jqv5-7xpx-qj74 sqlite vulnerable to code execution due to Object coercion

HIGH Published 2023-03-13 Modified 2023-03-16 Official page ↗
Aliases
CVE-2022-43441
Ecosystem
npm
Packages
sqlite3
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-913, CWE-915
Reviewed
2023-03-13

Affected packages

• npm sqlite3: >= 5.0.0, < 5.1.5 → fixed in 5.1.5

Description

Impact Due to the underlying implementation of `.ToString()`, it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object. Users of `sqlite3` v5.0.0 - v5.1.4 are affected by this. Patches Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later. Workarounds • Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters. References • Commit: https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781 For more information If you have any questions or comments about this advisory: • Email us at [email protected] Credits: Dave McDaniel of Cisco Talos

Related

Alias · CVE (1)

  • CVE-2022-43441 A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. vulnerability

Weakness · CWE (2)

  • CWE-913 Improper Control of Dynamically-Managed Code Resources weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References