Read the docs
TI-2022-21236 Aliases CVE-2022-43441GHSA-jqv5-7xpx-qj74

Mass assignment in TryGhost node-sqlite3

Priority MEDIUM 47CWE-915Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-915.

Summary

A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02356 83rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed sqlite3 (npm): 5.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TryGhostnode-sqlite35.1.1—No fix listedCNA
—sqlite3 (npm)5.0.0 to before 5.1.55.1.5Patch availableGHSA-jqv5-7xpx-qj74
  • node-sqlite3 VendorTryGhost Affected 5.1.1 Fixed in — No fix listed CNA
  • sqlite3 (npm) Vendor— Affected 5.0.0 to before 5.1.5 Fixed in 5.1.5 Patch available GHSA-jqv5-7xpx-qj74

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ghost:sqlite3:*:*:*:*:*:node.js:*:*5.0.0 to before 5.1.5VulnerableTryGhost
  • cpe:2.3:a:ghost:sqlite3:*:*:*:*:*:node.js:*:* Versions 5.0.0 to before 5.1.5 Vulnerable ·TryGhost

Remediation

  • Fix · GHSA-jqv5-7xpx-qj74 sqlite3 (npm) Fixed in 5.1.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43441
  2. 2026-10-03 Alias added: GHSA-jqv5-7xpx-qj74

References

Exploit 1

Advisory 2

Other 2

  • TI-2022-05619 Denial of service (DoS) in sqlite3 CVSS 3.1HIGH 7.5
  • TI-2020-15181 Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences