SQL Injection in Node.js SQLite Module

Executive Summary

This vulnerability involves a flaw in Node.js's node:sqlite module where a stale StatementSyncIterator continues executing a cached prepared statement after it has been reset and rebound with new parameters. The issue occurs because SQLTagStore resets cached statements using sqlite3_reset() directly, which bypasses the iterator invalidation mechanism introduced for StatementSync in recent Node.js releases.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a stale StatementSyncIterator in Node.js node:sqlite that may execute cached prepared statements after they are reset. To detect it, check Node.js applications using sqlite3 versions in 22.x, 24.x, or 26.x. Review code for DatabaseSync#createTagStore() usage and ensure StatementSync iterators are properly invalidated after sqlite3_reset() calls.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to execute unintended SQL statements by manipulating cached prepared statements. This may lead to unauthorized data access, modification, or deletion in applications using affected Node.js versions. The impact depends on the application's use of SQLite and the privileges of the database user.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance requirements such as GDPR or HIPAA by enabling unauthorized data access or modification. Organizations using affected Node.js versions may face increased risk of data breaches, leading to regulatory penalties, reputational damage, and loss of customer trust.

Useful 0 Not Useful 0

Mitigation Strategies

Update Node.js to the latest patched version for your release line (22.x, 24.x, or 26.x) to address the flaw in node:sqlite and ensure proper statement iterator invalidation.

Useful 0 Not Useful 0