7.8
HighCVSS 3.1 · from VulnCheck
CVE-2026-119586
SQLite CLI through 3.54.1 Command Injection via .recover Output
SQLite · Command injection · CWE-77AffectedSQLite
FixNo fix listed yet.
PublishedOct 30, 11:31 · VulnCheck
ScoredOct 30 · 7.8 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inSQLiteup to 3.54.1–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known