Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 16/03/2023 Updated: 22/03/2023

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ghost sqlite3

Dave McDaniel discovered that the SQLite3 bindings for Nodejs were susceptible to the execution of arbitrary JavaScript code if a binding parameter is a crafted object For the stable distribution (bullseye), this problem has been fixed in version 500+ds1-1+deb11u2 We recommend that you upgrade your node-sqlite3 packages For the detailed secur ...

CWE-913 https://github.com/TryGhost/node-sqlite3/security/advisories/GHSA-jqv5-7xpx-qj74 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1645 https://nvd.nist.gov https://www.debian.org/security/2023/dsa-5373

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2022-43441

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect