Command Injection in SQLite Command-Line Shell by SQLite
CVE-2026-119586

8.5HIGH

Key Information:

Vendor

Sqlite

Status
Sqlite
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119586?

The SQLite command-line shell versions prior to 3.54.1 contain a command injection vulnerability within the .recover command. This flaw allows attackers to embed malicious dot-commands directly into the sqlite_schema.sql values. When a victim executes the .recover command, it may unintentionally execute arbitrary OS commands, potentially compromising the system. This occurs when a crafted database schema includes a legitimate CREATE statement followed by .shell or .system commands, thereby executing unintended operations when the .recover output is piped into sqlite3.

Affected Version(s)

SQLite 0 <= 3.54.1

References

https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/...
technical-description
https://github.com/sqlite/sqlite/blob/version-3.54.1/src/...
technical-description
https://abraxaslabs.tech/research/sqlite-cli-recover
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
.