Packages / sqlite3 / Security

HighVulnerabilityGHSA-jqv5-7xpx-qj74CVE-2022-43441Published 13 Mar 2023

sqlite vulnerable to code execution due to Object coercion

Affected releases · sqlite3

  • 5.x5.0.0 – 5.1.4Fixed in 5.1.5

On 5.x, the newest line:

npm install sqlite3@5.1.5
6.x

  1. Not affected

    6.0.1

    1 release, latest

5.x

  1. Affected

    5.0.0 – 5.1.4

    17 releases

  2. Fixed

    5.1.5 – 5.1.7

    3 releases

104 stable releases of sqlite3, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for sqlite3. It is read in your browser and sent nowhere.

What happens

Impact

Due to the underlying implementation of .ToString(), it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.

Users of sqlite3 v5.0.0 - v5.1.4 are affected by this.

Patches

Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.

Workarounds

  • Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.

References

For more information

If you have any questions or comments about this advisory:

  • Email us at security@ghost.org

Credits: Dave McDaniel of Cisco Talos