{"id":"CVE-2026-119586","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-119586","summary":"SQLite CLI through 3.54.1 Command Injection via .recover Output","details":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.","published":"2026-10-30T11:31:15.070Z","modified":"2026-10-31T02:47:38.120857365Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"ADVISORY","url":"https://abraxaslabs.tech/research/sqlite-cli-recover"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119586.json"},{"type":"PACKAGE","url":"https://github.com/sqlite/sqlite"},{"type":"ARTICLE","url":"https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223"},{"type":"ARTICLE","url":"https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586"},{"type":"WEB","url":"https://sqlite.org/"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-31T02:47:38.120857365Z"}}