Sqlite3

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:ghost:sqlite3:*:*:*:*:*:node.js:*:*

part: a version: * update: *

VendorGhost (b50ba6a2-6882-52df-b0fe-d50a87f187b5)
ProductSqlite3 (f51e3c18-0a17-5b2c-98f7-7f3d32038305)
Edition*
Language*
Software edition*
Target softwarenode.js
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/node-sqlite3 purl2cpe 2026-06-01 10:11:00.159840
pkg:deb/ubuntu/node-sqlite3 purl2cpe 2026-06-01 10:11:00.159842
pkg:github/tryghost/node-sqlite3 purl2cpe 2026-06-01 10:11:00.159843
pkg:maven/org.webjars.npm/sqlite3 purl2cpe 2026-06-01 10:11:00.159845
pkg:npm/sqlite3 purl2cpe 2026-06-01 10:11:00.159846
pkg:sourceforge/sqlite3.mirror purl2cpe 2026-06-01 10:11:00.159848

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2022-43441 vulnerable 2026-06-08 05:49:31.939729 Details available
HIGH (8.1)
A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.
Published: 2023-03-16T20:14:14.090Z
Updated: 2024-08-03T13:32:59.404Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-21227 vulnerable 2026-06-08 05:40:00.498739 Denial of Service (DoS)
HIGH (7.5)
The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of the passed parameter. If passed an invalid Function object it will throw and crash the V8 engine.
Published: 2022-05-01T15:25:15.734Z
Updated: 2024-09-16T18:48:34.205Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.