CVE-2026-119586: SQLite CLI through 3.54.1 Command Injection via .recover Output
SQLite CLI through 3.54.1 Command Injection via .recover Output
Other sources
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqliteschema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.
— NVD
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the SQLite command-line shell through 3.54.1 are exposed when they process an attacker-controlled database with .recover and pipe the generated output into sqlite3. The described execution occurs on the victim system running the CLI.
What must an attacker provide to trigger command execution?
The attacker needs to craft a database with sqlite_schema.sql content containing a valid CREATE statement followed by a dot-command such as .shell or .system. The victim must run .recover and pipe its output into sqlite3.
Is running .recover alone sufficient to execute the injected command?
The described trigger requires piping .recover output into sqlite3. The provided information does not state that merely displaying or saving .recover output executes the planted dot-command.