Sqlite3 version 5.1.4 represents a minor update over its predecessor, version 5.1.3, within the asynchronous SQLite3 bindings library for Node.js. Both versions maintain the same core dependencies, including @mapbox/node-pre-gyp, node-addon-api, tar, and node-gyp, suggesting no fundamental changes to the library's architecture or its interactions with native SQLite3 binaries. The development dependencies for linting with eslint, testing with mocha, and pre-gyp publishing infrastructure, alongside peer and optional dependency on node-gyp remain constant, indicating stability in the development workflow and build process.
The license continues to be BSD-3-Clause. Also the repository location and author information are unchanged. However, some subtle shifts may be of interest to developers. While the file count in the distribution package remains the same at 23, the unpacked size of version 5.1.4 is slightly smaller (3242746 bytes) compared to version 5.1.3 (3243035 bytes). This could point to optimizations in code, assets, or build configurations, potentially resulting in a slightly leaner package. Critically, version 5.1.4 was released just hours after the previous version. Such a quick release cycle typically indicates a focused effort to address a bug fix or security vulnerability identified in version 5.1.3, although specific details are not provided in the metadata. Developers are advised to examine the release notes or commit history on the GitHub repository for a detailed breakdown of what was changed and determine whether the fixes affect their usage of the library.
All the vulnerabilities related to the version 5.1.4 of the package
sqlite vulnerable to code execution due to Object coercion
Due to the underlying implementation of .ToString()
, it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.
Users of sqlite3
v5.0.0 - v5.1.4 are affected by this.
Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.
If you have any questions or comments about this advisory:
Credits: Dave McDaniel of Cisco Talos