debian/node-sqlite3 vulnerabilities

Latest debian/node-sqlite3 CVEs

Newest publication first

1. CVE-2022-43441 sqlite vulnerable to code execution due to Object coercion

   Published 2023-03-16

   High·CVSS 8.1

   A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.

2. CVE-2022-21227 Denial of Service (DoS)

   Published 2022-05-01

   High·CVSS 7.5 EPSS 2.2%

   The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.