CVE-2026-119586
Received Received - Intake

SQLite Command Injection via .recover in sqlite3 CLI

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119586
EUVD
EUVD-2026-113834

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SQLite SQLite 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SQLite command-line shell up to version 3.54.1 has a command injection flaw in the .recover command. Attackers can embed malicious OS commands within a database's schema by including a valid CREATE statement followed by a .shell or .system dot-command. When victims run .recover on such a database, the tool executes the attacker's commands.

Detection Guidance

Check for SQLite versions before 3.54.2. Inspect database schemas for malicious .shell or .system commands embedded in sqlite_schema.sql values. Review command-line usage of .recover for unexpected OS command execution.

Impact Analysis

If you use the vulnerable SQLite shell and process a specially crafted database, attackers could execute arbitrary commands on your system with your privileges. This could lead to data theft, system compromise, or further network infiltration depending on your environment.

Compliance Impact

This vulnerability could violate compliance requirements that mandate secure handling of sensitive data (e.g., GDPR's integrity principle or HIPAA's security rule). Unauthorized command execution may lead to data breaches, unauthorized access, or loss of data integrity, triggering regulatory penalties.

Mitigation Strategies

Upgrade SQLite to version 3.54.2 or later. Avoid using .recover on untrusted databases. Validate database schemas for malicious dot-commands before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119586. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart