CVE-2026-119586 — Vulnerability intelligence

sqlite — sqlite

Published: 2026-10-30T11:31:15.070Z

CVSS

8.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.

Sources

• CVE-2026-119586
• Exploit, Third Party Advisory
• Product
• Product
• Product
• Third Party Advisory
• CVE-2026-119586