SQLite: Command injection in .recover command (CVE-2026-119586)

SQLite command-line shell versions up to and including 3.54.1 contain a command injection vulnerability in the .recover functionality. When a database contains a specially crafted 'sqlite_schema' table entry, the .recover command includes attacker-controlled dot-commands (e.g., .shell or .system) in its output. If a victim executes the .recover command and redirects or pipes the resulting output into an active SQLite shell session, the injected system commands will execute with the privileges of the user running the shell.

Attack Chain

1. Attacker creates a malicious database file containing a crafted sqlite_schema entry.
2. Attacker injects a malicious dot-command (e.g., .shell id) into the schema metadata.
3. Attacker lures or forces a victim to run the SQLite shell and execute the .recover command on the malicious database.
4. The .recover command outputs the attacker's malicious dot-commands to standard output.
5. The victim pipes this output into a new or existing sqlite3 process.
6. The sqlite3 shell interprets the piped input, parses the dot-commands, and executes the malicious OS command.

Recommendation

1. Identify and inventory all systems utilizing the SQLite command-line shell (sqlite3) through version 3.54.1.
2. Update all instances of the SQLite command-line shell to a version beyond 3.54.1 as soon as a patch becomes available.
3. Implement strict controls over the execution of the .recover command on untrusted or externally sourced database files.
4. Use the hunt lead below to identify potential usage of the .recover command in automated pipelines where redirection may occur.