Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck
CVE-2026-119586SQLite CLI through 3.54.1 Command Injection via .recover Output
High 7.8
In plain English
A high-severity command injection in SQLite from SQLite. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Official description
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | sqlite3 | no fix listed | DEBIAN-CVE-2026-119586 |
| Debian:13 | sqlite3 | no fix listed | DEBIAN-CVE-2026-119586 |
| Debian:14 | sqlite3 | no fix listed | DEBIAN-CVE-2026-119586 |
| Ubuntu:22.04:LTS | sqlite | no fix listed | UBUNTU-CVE-2026-119586 |
| Ubuntu:22.04:LTS | sqlite3 | no fix listed | UBUNTU-CVE-2026-119586 |
| Ubuntu:24.04:LTS | sqlite3 | no fix listed | UBUNTU-CVE-2026-119586 |
| Ubuntu:26.04:LTS | sqlite3 | no fix listed | UBUNTU-CVE-2026-119586 |
| Ubuntu:26.10 | sqlite3 | no fix listed | UBUNTU-CVE-2026-119586 |
Affected products (as reported)
Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223 technical-description
- https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891 technical-description
- https://abraxaslabs.tech/research/sqlite-cli-recover third-party-advisory
- https://github.com/sqlite/sqlite product
- VulnCheck Advisory: SQLite CLI through 3.54.1 Command Injection via .recover Output third-party-advisory