CVE-2022-46908

Published: Dec 12, 2022Modified: Jun 17, 2026

7.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Exploitability: 1.8 / Impact: 5.5

Source: NVD

Description

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

Affected (1)

Products: Sqlite: Sqlite

Sqlite

1 product

Sqlite

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sqlite Sqlite	From 3.37.0 to 3.40.1

References (10)

https://news.ycombinator.com/item?id=33948588

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://security.gentoo.org/glsa/202311-03

Source: cve@mitre.org

https://security.netapp.com/advisory/ntap-20230203-0005/

Source: cve@mitre.org

Third Party Advisory

https://sqlite.org/forum/forumpost/07beac8056151b2f

Source: cve@mitre.org

ExploitIssue TrackingVendor Advisory

https://sqlite.org/src/info/cefc032473ac5ad2

Source: cve@mitre.org

PatchVendor Advisory

https://news.ycombinator.com/item?id=33948588