{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/sqlite-command-line-shell--3.54.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-119586"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SQLite command-line shell (\u003c= 3.54.1)"],"_cs_severities":["high"],"_cs_tags":["sqlite","command-injection","vulnerability"],"_cs_type":"advisory","_cs_vendors":["SQLite"],"content_html":"\u003cp\u003eSQLite command-line shell versions up to and including 3.54.1 contain a command injection vulnerability in the .recover functionality. When a database contains a specially crafted 'sqlite_schema' table entry, the .recover command includes attacker-controlled dot-commands (e.g., .shell or .system) in its output. If a victim executes the .recover command and redirects or pipes the resulting output into an active SQLite shell session, the injected system commands will execute with the privileges of the user running the shell.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker creates a malicious database file containing a crafted sqlite_schema entry.\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious dot-command (e.g., .shell id) into the schema metadata.\u003c/li\u003e\n\u003cli\u003eAttacker lures or forces a victim to run the SQLite shell and execute the .recover command on the malicious database.\u003c/li\u003e\n\u003cli\u003eThe .recover command outputs the attacker's malicious dot-commands to standard output.\u003c/li\u003e\n\u003cli\u003eThe victim pipes this output into a new or existing sqlite3 process.\u003c/li\u003e\n\u003cli\u003eThe sqlite3 shell interprets the piped input, parses the dot-commands, and executes the malicious OS command.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eIdentify and inventory all systems utilizing the SQLite command-line shell (sqlite3) through version 3.54.1.\u003c/li\u003e\n\u003cli\u003eUpdate all instances of the SQLite command-line shell to a version beyond 3.54.1 as soon as a patch becomes available.\u003c/li\u003e\n\u003cli\u003eImplement strict controls over the execution of the .recover command on untrusted or externally sourced database files.\u003c/li\u003e\n\u003cli\u003eUse the hunt lead below to identify potential usage of the .recover command in automated pipelines where redirection may occur.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-30T13:30:02Z","date_published":"2026-10-30T13:30:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sqlite-recover-injection/","summary":"The SQLite command-line shell through version 3.54.1 is vulnerable to command injection because the .recover command emits malicious dot-commands stored in the database schema, which execute when the output is piped back into the shell.","title":"SQLite: Command injection in .recover command (CVE-2026-119586)","url":"https://feed.craftedsignal.io/briefs/2026-10-sqlite-recover-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - SQLite Command-Line Shell (\u003c= 3.54.1)","version":"https://jsonfeed.org/version/1.1"}