Skip to content
Threat Feed
Subscribe

Product

SQLite Command-Line Shell (<= 3.54.1)

1 brief RSS
high advisory

SQLite: Command injection in .recover command (CVE-2026-119586)

The SQLite command-line shell through version 3.54.1 is vulnerable to command injection because the .recover command emits malicious dot-commands stored in the database schema, which execute when the output is piped back into the shell.

SQLite command-line shell sqlite command-injection vulnerability
1t 1c