CVE-2022-43441
sqlite vulnerable to code execution due to Object coercion
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.
- Record
CVE-2022-43441- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-915
- Updated
- 2026-11-02
EUVDEUVD-2023-1051
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.
- Record
EUVD-2023-1051- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jqv5-7xpx-qj74
sqlite vulnerable to code execution due to Object coercion
Impact
Due to the underlying implementation of .ToString(), it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.
Users of sqlite3 v5.0.0 - v5.1.4 are affected by this.
Patches
Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.
Workarounds
- Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.
References
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
Credits: Dave McDaniel of Cisco Talos
- Record
GHSA-jqv5-7xpx-qj74- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-913, CWE-915
- Updated
- 2026-11-02
NVD
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.
- Record
CVE-2022-43441- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-915, CWE-913
- Updated
- 2026-11-02
OSV
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.
- Record
CVE-2022-43441- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-915
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-43441
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.
- Record
DEBIAN-CVE-2022-43441- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSVGHSA-jqv5-7xpx-qj74
sqlite vulnerable to code execution due to Object coercion
Impact
Due to the underlying implementation of .ToString(), it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.
Users of sqlite3 v5.0.0 - v5.1.4 are affected by this.
Patches
Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.
Workarounds
- Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.
References
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
Credits: Dave McDaniel of Cisco Talos
- Record
GHSA-jqv5-7xpx-qj74- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-913, CWE-915
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-43441
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.
- Record
UBUNTU-CVE-2022-43441- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sqlite3npm |
5.0.0 up to 5.1.5 | 5.1.5 |
node-sqlite3Debian:12 |
before 5.1.5+ds1-1 | 5.1.5+ds1-1 |
node-sqlite3Debian:13 |
before 5.1.5+ds1-1 | 5.1.5+ds1-1 |
node-sqlite3Debian:14 |
before 5.1.5+ds1-1 | 5.1.5+ds1-1 |
node-sqlite3Debian:11 |
before 5.0.0+ds1-1+deb11u2, plus listed versions 5.0.0+ds1-15.0.0+ds1-1+deb11u1 |
5.0.0+ds1-1+deb11u2 |
node-sqlite3Ubuntu:16.04:LTS |
All versions, plus listed versions 2.2.0+ds1-1 |
None known |
node-sqlite3Ubuntu:18.04:LTS |
All versions, plus listed versions 3.1.8+ds1-2build13.1.8+ds1-2build2 |
None known |
node-sqlite3Ubuntu:20.04:LTS |
All versions, plus listed versions 4.0.6+ds1-24.1.0+ds1-14.1.1+ds1-14.1.1+ds1-1build1 |
None known |
node-sqlite3Ubuntu:22.04:LTS |
All versions, plus listed versions 5.0.0+ds1-15.0.2+ds1-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-43441 is a high vulnerability (CVSS 8.1) in Ghost Sqlite3, published March 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.36%, the 83rd percentile. Fixed in sqlite3 5.1.5.
References
talosintelligence.com/vulnerability_reports/TALOS-2022-1645
github.com/TryGhost/node-sqlite3/security/advisories/GHSA-jqv5-7xpx-qj74
nvd.nist.gov/vuln/detail/CVE-2022-43441