GHSA-jqv5-7xpx-qj74

sqlite vulnerable to code execution due to Object coercion

Source: GitHub Advisory Database (reviewed) High CVE-2022-43441

Packages

Ecosystem	Package	Affected	Fixed in
npm	sqlite3	>= 5.0.0, < 5.1.5	5.1.5

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Due to the underlying implementation of `.ToString()`, it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object. Users of `sqlite3` v5.0.0 - v5.1.4 are affected by this. ### Patches Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later. ### Workarounds * Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters. ### References * Commit: https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781 ### For more information If you have any questions or comments about this advisory: * Email us at [[email protected]](mailto:[email protected]) Credits: Dave McDaniel of Cisco Talos

References

External links from the advisory. They lead to third-party sites.