CVE-2025-48935 Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using ATTACH DATABASE statement. Version 2.2.5 contains a patch for the issue...

CVE-2025-48935

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using "ATTACH DATABASE" statement. Version 2.2.5 contains a patch for the issue...

CVE-2025-48935: Incorrect Authorization

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 2.2.0 and prior to versions 2.2.5, it is possible to bypass Deno's permission read/write db permission check by using ATTACH DATABASE statement. Version 2.2.5 contains a patch for the issue...

PT-2025-23850 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions 2.2.0 through 2.2.4 Description: The issue allows bypassing Deno's permission read/write db permission check by using the ATTACH DATABASE statement. Recommendations: For Deno versions 2.2.0 through 2.2.4, update to version 2.2.5...

Deno security vulnerabilities

Deno is a simple, modern and secure JavaScript and TypeScript runtime environment from Deno Open Source. A security vulnerability exists in Deno versions prior to 2.2.0 through 2.2.5, which stems from a read/write permission check that can be bypassed via the ATTACH DATABASE statement...

RUSTSEC-2025-0138 --allow-read / --allow-write permission bypass in `node:sqlite`

It is possible to bypass Deno's read/write permission checks by using ATTACH DATABASE statement. PoC // poc.js import DatabaseSync from "node:sqlite" const db = new DatabaseSync":memory:"; db.exec"ATTACH DATABASE 'test.db' as test;"; db.exec"CREATE TABLE test.test id INTEGER PRIMARY KEY, name...

--allow-read / --allow-write permission bypass in `node:sqlite`

It is possible to bypass Deno's read/write permission checks by using ATTACH DATABASE statement. PoC // poc.js import DatabaseSync from "node:sqlite" const db = new DatabaseSync":memory:"; db.exec"ATTACH DATABASE 'test.db' as test;"; db.exec"CREATE TABLE test.test id INTEGER PRIMARY KEY, name...

CVE-2024-35181

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the...

GHSA-H7CM-JVPP-69XF Meshery SQL Injection vulnerability

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the...

SQL Injection

Meshery is vulnerable to SQL Injection. The vulnerability is due to improper handling of the sort query parameter in the GetAllEvents function, allowing for SQL injection through stacked queries and the ATTACH DATABASE command...

SQL Injection

Meshery is vulnerable to SQL Injection. The vulnerability is due to improper handling of the order query parameter in the GetMeshSyncResourcesKinds function, allowing for SQL injection through stacked queries and the ATTACH DATABASE command...

CVE-2024-35182 GHSL-2024-014 Meshery SQL Injection vulnerability

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructure and applications. A SQL injection vulnerability in Meshery prior to version 0.7.22 may lead to arbitrary file write by using a SQL injection stacked queries payload, and the...

Meshery security vulnerabilities

Meshery is a software application. A multi-service grid management plane that provides lifecycle, configuration and performance management of service grids and their workloads. A security vulnerability exists in Meshery versions prior to 0.7.22, which stems from the presence of a SQL injection...

Meshery security vulnerabilities

Meshery is a software application. A multi-service grid management plane that provides lifecycle, configuration and performance management of service grids and their workloads. A security vulnerability exists in Meshery versions prior to 0.7.22, which stems from the presence of a SQL injection...

CVE-2022-24854

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...

CVE-2022-24854

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called "ATTACH DATABASE", which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attac...

CVE-2022-24854: Externally Controlled Reference to a Resource in Another Sphere

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called ATTACH DATABASE, which allows connecting multiple SQLite databases via the initial connection. If the attacker has SQL permissions to at least one SQLite database, then it can attach...

PT-2022-16928

Name of the Vulnerable Software and Affected Versions Metabase affected versions not specified Description The issue concerns Metabase, an open source business intelligence and analytics application, specifically affecting users who make use of SQLite. SQLite has a feature called ATTACH DATABASE,...

CVE-2007-4664: Improper Input Validation

Unspecified vulnerability in the 1 attach database and 2 create database functionality in Firebird before 2.0.2, when a filename exceeds MAXPATHLEN, has unknown impact and attack vectors, aka CORE-1405...