UBUNTU-CVE-2026-119586: SQL Injection
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqliteschema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of the SQLite command-line shell are exposed when they run .recover against an attacker-controlled database and pipe that output back into sqlite3. The affected component is listed as SQLite command-line shell through 3.54.1.
What does an attacker need to exploit this?
An attacker needs to provide a crafted SQLite database whose sqlite_schema.sql value contains a valid CREATE statement followed by a dot-command such as .shell or .system. Exploitation also requires a victim to process the .recover output by piping it into sqlite3.
What can be done before a patch is available?
Do not pipe .recover output from untrusted databases directly into sqlite3. Treat recovered SQL as untrusted input and avoid executing it when it may contain attacker-controlled schema content.