What is GHSA-jqv5-7xpx-qj74?

GHSA-jqv5-7xpx-qj74 is a security advisory published by GitHub Security Advisories with High severity. sqlite vulnerable to code execution due to Object coercion

Which CVE IDs does GHSA-jqv5-7xpx-qj74 cover?

GHSA-jqv5-7xpx-qj74 covers the following CVE IDs: CVE-2022-43441. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jqv5-7xpx-qj74?

GHSA-jqv5-7xpx-qj74 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-jqv5-7xpx-qj74?

GHSA-jqv5-7xpx-qj74 affects 1 product, including: npm/sqlite3:\u003e= 5.0.0, \u003c 5.1.5.

GHSA-jqv5-7xpx-qj74HighCVSS 8.1

sqlite vulnerable to code execution due to Object coercion

Vendor

GitHub Security Advisories

Published

March 13, 2023

Last Modified

March 22, 2023

🔗 CVE IDs covered (1)

CVE-2022-43441 →

📋 Description

Impact

Due to the underlying implementation of .ToString(), it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.

Users of sqlite3 v5.0.0 - v5.1.4 are affected by this.

Patches

Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.

Workarounds

Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.

References

Commit: https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

Credits: Dave McDaniel of Cisco Talos

🎯 Affected products1

npm/sqlite3:>= 5.0.0, < 5.1.5