SQLite

SQLite versions prior to 3.54.0, when compiled with FTS5, contain a heap buffer overflow vulnerability that allows local memory corruption or process crashes via crafted prefix MATCH queries.

The SQLite command-line shell through version 3.54.1 is vulnerable to command injection because the .recover command emits malicious dot-commands stored in the database schema, which execute when the output is piped back into the shell.

A heap buffer overflow in the SQLite SQLAR extension (CVE-2026-39113) occurs when an attacker triggers sqlar_uncompress with a 64-bit size value that gets truncated during memory allocation, leading to heap corruption and potential denial of service.

A JSON-path traversal injection vulnerability exists in Kysely versions prior to 0.28.16, allowing attackers to traverse JSON sub-fields outside the intended scope, potentially leading to unauthorized read and write access to sensitive data in MySQL, PostgreSQL, and SQLite databases due to insufficient sanitization of JSON-path metacharacters in the `JSONPathBuilder.key()` and `.at()` functions.

Diesel versions before 2.3.8 are vulnerable to UTF-8 corruption due to the `sqlite3_value_text` function not always returning UTF-8 encoded strings, potentially leading to invalid UTF-8 string processing without validation.