SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.
| CVE | CVE-2026-119586 |
|---|---|
| Severidad | HIGH |
| CVSS | 7.8 / 10 |
| CWE | CWE-77 |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Producto afectado
SQLite command-line shell 3.54.1
Producto derivado de la descripción (el CPE estructurado de NVD aún no está publicado).