{"id":"CVE-2026-119586","kind":"vulnerability","aliases":["CVE-2026-119586"],"related":[],"title":"SQLite shell: crafted database runs OS commands via .recover","description":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.","summary":"The SQLite command-line shell's .recover command copies schema text from a database without filtering it, so a planted line such as .shell or .system is written out as a dot-command. When a victim pipes that recovered output back into sqlite3, the attacker's commands run on the victim's machine.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sqlite","fixed":[],"affected":"<= 3.54.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","developer-tools","package","sqlite","sqlite3-cli"],"not_affected_if":["library-only-use","managed-hosting","no-untrusted-databases"],"how_to_check":"- Run sqlite3 --version. 3.54.1 and earlier are listed as affected (the researcher lab-tested 3.53.4); no fixed release exists yet.\n- Look for scripts or runbooks that run 'sqlite3 x.db .recover | sqlite3 y.db', or '.recover > data.sql' followed by 'sqlite3 new.db < data.sql', on databases from outside your team.\n- Before restoring, run 'grep -n \"^\\.\" data.sql'. Any dot-command other than the .dbconfig line that .recover prints itself (for example .shell or .system) means the database was tampered with.","fix":"No fixed SQLite release as of 3.54.1 (2026-10-16), the latest on sqlite.org/changes.html. Until one ships, do not pipe .recover or .dump output from untrusted databases straight into sqlite3; read the script first.","status":"open","published_at":"2026-10-30T12:16:44+00:00","first_seen_at":"2026-10-30T12:30:27+00:00","triaged_at":"2026-10-30T12:32:04+00:00","updated_at":"2026-10-30T12:32:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T12:32:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"SQLite shell: crafted database runs OS commands via .recover","impact":"high","summary":"The SQLite command-line shell's .recover command copies schema text from a database without filtering it, so a planted line such as .shell or .system is written out as a dot-command. When a victim pipes that recovered output back into sqlite3, the attacker's commands run on the victim's machine.","audience":"developers","category":"package","nicknames":[],"who_cares":["sqlite","sqlite3-cli","developer-tools"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"OS commands run as the user who runs sqlite3","analyst_note":"Confirm the fixed SQLite version and whether the NVD CVSS 8.5 score matches vendor or sqlite.org advisories at https://nvd.nist.gov/vuln/detail/CVE-2026-119586.","how_to_check":"- Run `sqlite3 --version` and compare against the fixed release in the sources (unknown here)\n- Check whether scripts or people pipe `.recover` output into `sqlite3` on machines that open untrusted database files","plain_action":"","needs_analyst":true,"not_affected_if":["library-only-use","no-untrusted-databases"],"who_is_affected":"Exposure requires a victim to open a malicious database with the sqlite3 shell's .recover command and feed the output back into sqlite3. Applications that link the SQLite library without the command-line shell are not exposed by this flaw. Teams that run recovery of untrusted database files from the shell should look at that workflow first.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4149,"output_tokens":590,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed SQLite version and whether the NVD CVSS 8.5 score matches vendor or sqlite.org advisories at https://nvd.nist.gov/vuln/detail/CVE-2026-119586.","search":"'-119586':12A,15A '-2026':11A,14A '3.54.1':89C 'attack':74B,102C,112C 'attacker-pl':101C 'back':70B 'cli':27B 'command':7A,18B,31B,36B,62B,76B,85C,92C,98C,106C,133C 'command-inject':17B 'command-lin':30B,84C 'contain':90C 'copi':37B 'craft':3A,114C 'creat':122C 'cve':10A,13A 'databas':4A,42B,116C 'develop':21B 'developer-tool':20B 'dot':61B,105C 'dot-command':60B,104C 'emit':100C 'execut':131C 'filter':44B 'follow':124C 'hold':119C 'inject':19B,93C 'line':32B,49B,86C,130C 'machin':82B 'os':6A,132C 'output':69B,138C 'packag':23B 'pipe':66B,136C 'plant':48B,103C 'recov':9A,35B,68B,97C,137C 'run':5A,77B 'schema':38B,118C 'shell':2A,33B,52B,87C,127C 'sqlite':1A,16A,24B,29B,83C 'sqlite3':26B,72B,140C 'sqlite3-cli':25B 'sqlite_schema.sql':109C 'statement':123C 'store':107C 'system':54B,129C 'text':39B 'tool':22B 'valid':121C 'valu':110C 'verbatim':111C 'via':8A 'victim':65B,80B,135C 'vulner':94C 'whose':117C 'without':43B 'written':56B","nicknames":[],"mitigations":[],"who_affected":"Exposure requires a victim to open a malicious database with the sqlite3 shell's .recover command and feed the output back into sqlite3. Applications that link the SQLite library without the command-line shell are not exposed by this flaw. Teams that run recovery of untrusted database files from the shell should look at that workflow first.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T12:16:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-119586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586","severity":null,"published_at":"2026-10-30T12:16:44+00:00","modified_at":"2026-10-30T12:16:44+00:00","first_seen_at":"2026-10-30T12:30:27+00:00","fetched_at":"2026-10-30T12:30:27+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119586:1152","url":null,"severity":null,"published_at":"2026-10-30T12:32:55+00:00","modified_at":"2026-10-30T12:32:55+00:00","first_seen_at":"2026-10-30T12:32:55+00:00","fetched_at":"2026-10-30T12:32:55+00:00","note":"Read VulnCheck advisory (CVSS 4.0 8.5, matches NVD; Abraxas Labs credited) and the researcher's write-up with a public PoC (lab-tested on 3.53.4, local, victim must pipe .recover output into a second sqlite3). sqlite.org/changes.html lists no fix through 3.54.1; sqlite.org does not appear to have acknowledged it, so fix is unknown rather than confirmed absent. Nothing verified: no vendor advisory exists. Exploitation in the wild: none seen. Researcher's own score was CVSS 3.1 7.8, so 8.5 is VulnCheck's v4 score."}],"documents":[{"id":23431,"url":"https://sqlite.org/changes.html","title":"SQLite Release History (latest 3.54.1, no .recover fix listed)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":23432,"url":"https://abraxaslabs.tech/research/sqlite-cli-recover","title":"Abraxas Labs: SQLite CLI .recover emits hostile schema as dot-command","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":23434,"url":"https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output","title":"VulnCheck advisory: SQLite CLI through 3.54.1 .recover command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":23436,"url":"https://sqlite.org/cves.html","title":"SQLite.org: Vulnerabilities (vendor stance on CVEs)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}