CVE-2022-43441

moderate-risk
Published 2023-03-16

A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.

Do I need to act?

~
6.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.1/10 High
NETWORK / HIGH complexity

Affected Products (1)

Sqlite3

Affected Vendors

Ghost

References (5)

Vendor Advisory https://github.com/TryGhost/node-sqlite3/security/advisories/GHSA-jqv5-7xpx-qj74
Exploit https://talosintelligence.com/vulnerability_reports/TALOS-2022-1645
Vendor Advisory https://github.com/TryGhost/node-sqlite3/security/advisories/GHSA-jqv5-7xpx-qj74
Exploit https://talosintelligence.com/vulnerability_reports/TALOS-2022-1645
https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1645
38
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 9/34 · Low
Exposure 5/34 · Minimal