CVE-2022-43441: SQL Injection
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/node-sqlite3to a version that resolves this vulnerability.Fixed in 5.1.5+ds1-1Fixed in 6.0.1+ds1-1 - Upgrade
Upgrade
debian/node-sqlite3to a version that resolves this vulnerability.Fixed in 5.1.5+ds1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-43441?
CVE-2022-43441 is a critical severity vulnerability that allows for arbitrary code execution.
How do I fix CVE-2022-43441?
To fix CVE-2022-43441, update the node-sqlite3 package to version 5.1.5 or later.
What versions are affected by CVE-2022-43441?
CVE-2022-43441 affects node-sqlite3 versions between 5.0.0 and 5.1.4 inclusive.
What is the impact of CVE-2022-43441?
The impact of CVE-2022-43441 is that an attacker can execute arbitrary code on a vulnerable system.
How does CVE-2022-43441 occur?
CVE-2022-43441 occurs when a specially-crafted JavaScript file exploits the Statement Bindings functionality.