Every CVE Search/ Get API key

CVE-2022-46908

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not...

7.3 HighFix available

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

0.45%Down 1.1 points since Dec 12, 2022
90%50%10%1%

What each source reports

NVD Score used 7.3

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Record
CVE-2022-46908
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
CVE List 7.3

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Record
CVE-2022-46908
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
EUVDEUVD-2022-49687 7.3

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Record
EUVD-2022-49687
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-993x-6558-2xmj 9.8

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not...

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Record
GHSA-993x-6558-2xmj
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-11586 7.3

CVE-2022-46908 affecting package sqlite for versions less than 3.39.2-2

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Record
AZL-11586
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVBELL-CVE-2022-46908 7.3
Record
BELL-CVE-2022-46908
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
Show 13 moreShow less
OSV 7.3

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Record
CVE-2022-46908
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVOESA-2022-2146 9.8

sqlite security update

Security Fix(es):

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.(CVE-2022-46908)

Record
OESA-2022-2146
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2023-1219 9.8

sqlite security update

SQLite is a C-language library that implements a small, fast, self-contained, high-reliability, full-featured, SQL database engine. SQLite is the most used database engine in the world. SQLite is built into all mobile phones and most computers and comes bundled inside countless other applications that people use every day.It also include lemon and sqlite3_analyzer and tcl tools.

Security Fix(es):

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.(CVE-2022-46908)

Record
OESA-2023-1219
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2022-46908 7.3

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Record
UBUNTU-CVE-2022-46908
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVBIT-sqlite-2022-46908 No score

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Record
BIT-sqlite-2022-46908
Updated
2026-11-02
OSVDEBIAN-CVE-2022-46908 No score

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Record
DEBIAN-CVE-2022-46908
Updated
2026-11-03
OSVMGASA-2023-0094 No score

Updated sqlite3 packages fix security vulnerability

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. (CVE-2022-46908)

Record
MGASA-2023-0094
Updated
2026-11-02
OSVopenSUSE-SU-2024:12574-1 No score

libsqlite3-0-3.40.0-2.1 on GA media

These are all security issues fixed in the libsqlite3-0-3.40.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12574-1
Updated
2026-11-02
OSVSUSE-SU-2022:4603-1 No score

Security update for sqlite3

This update for sqlite3 fixes the following issues:

  • CVE-2022-46908: Properly implement the azProhibitedFunctions protection mechanism, when relying on --safe for execution of an untrusted CLI script (bsc#1206337).
Record
SUSE-SU-2022:4603-1
Updated
2026-11-02
OSVSUSE-SU-2022:4628-1 No score

Security update for sqlite3

This update for sqlite3 fixes the following issues:

  • CVE-2022-46908: Properly implement the azProhibitedFunctions protection mechanism, when relying on --safe for execution of an untrusted CLI script (bsc#1206337).
Record
SUSE-SU-2022:4628-1
Updated
2026-11-02
OSVSUSE-SU-2023:1295-1 No score

Security update for sqlite3

This update for sqlite3 fixes the following issues:

  • CVE-2022-46908: Properly implement the azProhibitedFunctions protection mechanism, when relying on --safe for execution of an untrusted CLI script (bsc#1206337).
Record
SUSE-SU-2023:1295-1
Updated
2026-11-02
OSVSUSE-SU-2023:2668-1 No score

Security update for sqlite3

This update for sqlite3 fixes the following issues:

  • CVE-2022-46908: Properly implement the azProhibitedFunctions protection mechanism, when relying on --safe for execution of an untrusted CLI script (bsc#1206337).
Record
SUSE-SU-2023:2668-1
Updated
2026-11-02
OSVUSN-6566-1 No score

sqlite3 vulnerabilities

It was discovered that SQLite incorrectly handled certain protection mechanisms when using a CLI script with the --safe option, contrary to expectations. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-46908)

It was discovered that SQLite incorrectly handled certain memory operations in the sessions extension. A remote attacker could possibly use this issue to cause SQLite to crash, resulting in a denial of service. (CVE-2023-7104)

Record
USN-6566-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sqlite
Azure Linux:2
 before 3.39.2-2
3.39.2-2
sqlite
Alpaquita:23
 3.40.0-r0 up to 3.40.1-r0
3.40.1-r0
sqlite
BellSoft Hardened Containers:23
 3.40.0-r0 up to 3.40.1-r0
3.40.1-r0
sqlite
Bitnami
 3.37.0 up to 3.40.1
3.40.1
sqlite3
Debian:12
 before 3.40.0-2
3.40.0-2
sqlite3
Debian:13
 before 3.40.0-2
3.40.0-2
sqlite3
Debian:14
 before 3.40.0-2
3.40.0-2
sqlite3
Mageia:8
 before 3.39.2-1.1.mga8
3.39.2-1.1.mga8
sqlite
openEuler:22.03-LTS
 before 3.37.2-4.oe2203
3.37.2-4.oe2203
sqlite
openEuler:22.03-LTS-SP1
 before 3.37.2-5.oe2203sp1
3.37.2-5.oe2203sp1
Show 36 moreShow less
Affected packages
PackageAffectedFixed
sqlite3
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 3.39.3-9.26.1
3.39.3-9.26.1
sqlite3
SUSE:Linux Enterprise Server 12 SP5
 before 3.39.3-9.26.1
3.39.3-9.26.1
sqlite3
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 3.39.3-9.26.1
3.39.3-9.26.1
sqlite3
SUSE:Linux Enterprise Micro 5.3
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise Real Time 15 SP3
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise Micro 5.1
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise Micro 5.2
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
openSUSE:Leap Micro 5.2
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
openSUSE:Leap Micro 5.3
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
openSUSE:Leap 15.3
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
openSUSE:Leap 15.4
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Manager Proxy 4.2
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Manager Server 4.2
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Enterprise Storage 7
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:Enterprise Storage 7.1
 before 3.39.3-150000.3.20.1
3.39.3-150000.3.20.1
sqlite3
SUSE:OpenStack Cloud 9
 before 3.39.3-9.26.1
3.39.3-9.26.1
sqlite3
SUSE:OpenStack Cloud Crowbar 9
 before 3.39.3-9.26.1
3.39.3-9.26.1
sqlite3
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 3.39.3-9.26.1
3.39.3-9.26.1
sqlite3
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 3.39.3-9.26.1
3.39.3-9.26.1
sqlite3
SUSE:Linux Enterprise Server 12 SP4-ESPOS
 before 3.39.3-9.26.1
3.39.3-9.26.1
sqlite3
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 3.39.3-9.26.1
3.39.3-9.26.1
sqlite3
Ubuntu:22.04:LTS
 before 3.37.2-2ubuntu0.3, plus listed versions
3.35.5-13.36.0-23.37.2-23.37.2-2ubuntu0.1
3.37.2-2ubuntu0.3
sqlite3
Ubuntu:20.04:LTS
From an advisory covering 2 CVEs
 before 3.31.1-4ubuntu0.6, plus listed versions
3.29.0-23.30.1-13.30.1-1ubuntu13.31.1-1ubuntu13.31.1-3
Show 6 moreShow less
3.31.1-43.31.1-4ubuntu0.13.31.1-4ubuntu0.23.31.1-4ubuntu0.33.31.1-4ubuntu0.43.31.1-4ubuntu0.5
3.31.1-4ubuntu0.6
sqlite3
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 3.37.2-2ubuntu0.3, plus listed versions
3.35.5-13.36.0-23.37.2-23.37.2-2ubuntu0.1
3.37.2-2ubuntu0.3
sqlite3
openSUSE:Tumbleweed
 before 3.40.0-2.1
3.40.0-2.1

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-46908 is a high vulnerability (CVSS 7.3) in Sqlite, published December 12, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 38th percentile. Fixed in sqlite 3.39.2-2.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open