CVE-2026-119586
SQLite CLI through 3.54.1 Command Injection via .recover Output
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.
| CWE | CWE-77 |
| Vendor | sqlite |
| Product | sqlite |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for sqlite sqlite
Be the first to know when new high vulnerabilities affecting sqlite sqlite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
SQLite / SQLite
0 ≤ 3.54.1
References
github.com: https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223 github.com: https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891 abraxaslabs.tech: https://abraxaslabs.tech/research/sqlite-cli-recover github.com: https://github.com/sqlite/sqlite vulncheck.com: https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output
Credits
Abraxas Labs