Arbitrary Code Execution

sqlite3 is vulnerable to Arbitrary Code Execution. The vulnerability exists due to the .ToString implementation because it calls the napicoercetostring function which can execute JavaScript when passed a crafted Napi::Value object, allowing an attacker to execute arbitrary JavaScript in the brows...

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0 12.18.0 and < 14.4.0.

...

CVE-2020-8174

napigetvaluestring allows various kinds of memory corruption in node 10.21.0, 12.18.0, and 14.4.0...

PT-2020-4060

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to 10.21.0 Node.js versions prior to 12.18.0 Node.js versions prior to 14.4.0 Description: The issue is related to memory corruption in the napi get value string functions, specifically napi get value string latin1, nap...