-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RustRustMiggo AIRoot Cause AnalysisThe vulnerability stems from closure parameters accepting 'fn' pointers instead of 'Fn' traits with proper 'static lifetimes. All listed functions register callbacks that SQLite might invoke later, but their pre-patch implementations allowed capturing stack-allocated values. The GHSA example with update_hook demonstrates concrete UAF through Mutex capture, and the advisory explicitly lists all 7 functions across three feature groups as impacted. The high confidence comes from reproducible crashes in user reports and explicit function enumeration in multiple authoritative sources (GHSA, RustSec, and project issues).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rusqlite | rust | >= 0.26.0, < 0.26.2 | 0.26.2 |
| rusqlite | rust | >= 0.25.0, < 0.25.4 | 0.25.4 |
Ongoing coverage of React2Shell