GHSA-jqv5-7xpx-qj74

Source

https://github.com/advisories/GHSA-jqv5-7xpx-qj74

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-jqv5-7xpx-qj74/GHSA-jqv5-7xpx-qj74.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-jqv5-7xpx-qj74

Aliases

CVE-2022-43441

Published

2023-03-13T20:00:52Z

Modified

2026-05-01T04:30:06Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

sqlite vulnerable to code execution due to Object coercion

Details

Impact

Due to the underlying implementation of .ToString(), it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.

Users of sqlite3 v5.0.0 - v5.1.4 are affected by this.

Patches

Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.

Workarounds

Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.

References

Commit: https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781

For more information

If you have any questions or comments about this advisory:

Email us at security@ghost.org

Credits: Dave McDaniel of Cisco Talos

Database specific

{
    "cwe_ids":  [
        "CWE-913",
        "CWE-915"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-03-13T20:00:52Z",
    "nvd_published_at":  "2023-03-16T21:15:00Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / sqlite3

Package

Name: sqlite3; View open source insights on deps.dev
Purl: pkg:npm/sqlite3

Affected ranges

Type: SEMVER
Events: Introduced

5.0.0

Fixed

5.1.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/03/GHSA-jqv5-7xpx-qj74/GHSA-jqv5-7xpx-qj74.json"