High severity - Arbitrary Code Execution vulnerability in sqlite3 (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: sqlite3
• Introduced through: juice-shop@12.3.0 and sqlite3@5.0.2

Detailed paths

• Introduced through: juice-shop@12.3.0 › sqlite3@5.0.2

Overview

Affected versions of this package are vulnerable to Arbitrary Code Execution via the .ToString() method due to improper sanitization. Exploiting this vulnerability is possible when a binding parameter is a crafted Object and might result in arbitrary JavaScript code execution or DoS.

Workarounds

Ensure sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.

Remediation

Upgrade sqlite3 to version 5.1.5 or higher.

References

• GitHub Commit
  
  SNYK-JS-SQLITE3-3358947
  (CVE-2022-43441) sqlite3@5.0.2