CVE-2026-119586 in SQLite 3.46.*

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.

Severity

High 7.8

Exploitation

2% chance of exploit
in the next 30 days

Fix

No fixed version listed yet

Where

Test dependency

How it matched

Version line match

First seen

2026-11-05 01:13:58 UTC

Source

https://nvd.nist.gov/vuln/detail/CVE-2026-119586