Skip to main content

Improper Control of Dynamically-Managed Code Resources in org.webjars.npm:sqlite3

CVE-2022-43441

  • org.webjars.npm:sqlite3
  • sqlite3
High
9.8/10

Summary

A code execution vulnerability exists in the Statement Bindings functionality of the package sqlite3 versions 5.x prior to 5.1.5. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-913 - Improper Control of Dynamically-Managed Code Resources

The software does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

References

Advisory Timeline

  • Published