7.3

CVE-2022-46908: sqlite

CVSS: 7.3v3.1HighModified
AliasesMGASA-2023-0094SUSE-SU-2022:4603-1SUSE-SU-2022:4628-1
Published 12-12-2022Last modified 14-10-2026
Open JSON

Vulnerability summary

CVE-2022-46908 is a high (CVSS 7.3) vulnerability in sqlite. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.4% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
39/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.3/10
010
High · v3.1 (CVE.org)
EPSS score
0.45%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 3
USN-6566-1CGA-9V6F-253V-7JX3CGA-X4GM-3R9H-V9H4

Timeline

  1. 12-12-2022
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.45%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

+0.02 pp

From 0.43% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.45%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (news.ycombinator.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (sqlite.org)

    Maturity: unknown

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Suse28 products
  • sqlite3&distro=SUSE Enterprise Storage 7< 3.39.3-150000.3.20.1
  • sqlite3&distro=SUSE Enterprise Storage 7.1< 3.39.3-150000.3.20.1
  • sqlite3&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 3.39.3-150000.3.20.1
  • sqlite3&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 3.39.3-150000.3.20.1
  • sqlite3&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 3.39.3-150000.3.20.1
Opensuse5 products
  • sqlite3&distro=openSUSE Leap 15.3< 3.39.3-150000.3.20.1
  • sqlite3&distro=openSUSE Leap 15.4< 3.39.3-150000.3.20.1
  • sqlite3&distro=openSUSE Leap Micro 5.2< 3.39.3-150000.3.20.1
  • sqlite3&distro=openSUSE Leap Micro 5.3< 3.39.3-150000.3.20.1
  • sqlite3&distro=openSUSE Tumbleweed< 3.40.0-2.1
Chainguard1 product
  • sqliteAll versions (No fix recorded)
Debian1 product
  • sqlite3< 3.40.0-2
Mageia1 product
  • sqlite3< 3.39.2-1.1.mga8
Sqlite1 product
Ubuntu1 product
  • sqlite3< 3.37.2-2ubuntu0.3
Wolfi1 product
  • sqliteAll versions (No fix recorded)

8 vendors · 39 products

References

23 links
Show all 23 references