sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger

Summary sqlite3-ruby cast Ruby string lengths long to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB 2^32 bytes or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the quer...

GHSA-4FQR-96Q8-XRFX sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger

Summary sqlite3-ruby cast Ruby string lengths long to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB 2^32 bytes or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the quer...

CVE-2026-128084

sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Databaseprepare, bound String or Blob values through Statementbindparam, and String or Blob results from Ruby-defined SQL functions and...

CVE-2026-128084 sqlite3-ruby: SQL Query Truncation

sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Databaseprepare, bound String or Blob values through Statementbindparam, and String or Blob results from Ruby-defined SQL functions and...

EUVD-2025-25172

Malicious code in bioql PyPI...

CVE-2025-50567

Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare function, which uses pregreplace with the deprecated /e eval modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code...

CVE-2025-50567

Saurus CMS Community Edition version 4.7.1 is vulnerable to a security flaw within the custom DB::prepare() function. The root cause is the use of preg_replace() with the deprecated /e (eval) modifier to interpolate SQL query parameters, which allows for the injection of user-controlled SQL state...

CVE-2025-50567

Saurus CMS Community Edition 4.7.1 contains a vulnerability in the custom DB::prepare function, which uses pregreplace with the deprecated /e eval modifier to interpolate SQL query parameters. This leads to injection of user-controlled SQL statements, potentially leading to arbitrary PHP code...