CVE-2022-43441 HIGH

CVE-2022-43441

Vendor Ghost Foundation

Product node-sqlite3

Weakness CWE-915

Published March 16, 2023

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

8.1/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.

Key dates

02Disclosure timeline

March 16, 2023 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-43441 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/915.html

Related vulnerabilities

04Related CVE

CVE-2026-5708 Improper Control of User-Modifiable Attributes in RES CreateSession API CVE-2025-24370 Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass CVE-2024-3283 Privilege Escalation via Mass Assignment in mintplex-labs/anything-llm CVE-2021-32807 Remote Code Execution via unsafe classes in otherwise permitted modules CVE-2026-40486 Kimai's User Preferences API allows standard users to modify restricted attributes: hourly_rate, internal_rate