Fluid Attacks Database

Description

A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	node-sqlite3	=5.0.0+ds1-1 \|\| =5.0.0+ds1-1+deb11u1 \|\| >=0 <5.0.0+ds1-1+deb11u2	5.0.0+ds1-1+deb11u2
npm	sqlite3	>=5.0.0 <5.1.5	5.1.5
debian 12	node-sqlite3	>=0 <5.1.5+ds1-1	5.1.5+ds1-1
debian 13	node-sqlite3	>=0 <5.1.5+ds1-1	5.1.5+ds1-1
debian 14	node-sqlite3	>=0 <5.1.5+ds1-1	5.1.5+ds1-1

Aliases

1. CVE-2022-434412. NVD-2022-434413. OSV-DEBIAN-2022-434414. OSV-2022-434415. GHSA-jqv5-7xpx-qj746. GCVE-2022-434417. SECURITY-TRACKER-CVE-2022-43441

References

1. https://github.com/TryGhost/node-sqlite3/security/advisories/GHSA-jqv5-7xpx-qj742. https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c7813. https://talosintelligence.com/vulnerability_reports/TALOS-2022-1645

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.