Vulnerability Spotlight: Node-SQLite3 issue could lead to denial of service in Ghost CMS
Summary: Cisco Talos discovered a vulnerability in the node-sqlite3 library, tracked as TALOS-2022-1645 (CVE-2022-43441), that can be triggered by sending a specially crafted JSON object. In Ghost CMS the JSON format limitations mean it only causes a remote denial of service that crashes the Node.js process, but Talos says it could potentially lead to remote code execution in other products using the library.
Bottom line: The flaw is rated as a remote code execution vulnerability in node-sqlite3 generally, yet in Ghost it is limited to crashing the Node.js process - so the same library carries a different blast radius depending on which product ships it, and Ghost users are directed to update to node-sqlite3 5.1.1.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-43441
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026