CVE-2026-119586

HighCVSS 7.8/10Last modified Nov 3, 2026

Description

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
SQLite	SQLite	<= 3.54.1

References

https://abraxaslabs.tech/research/sqlite-cli-recoverExploit, Third Party Advisory
https://github.com/sqlite/sqliteProduct
https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223Product
https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891Product
https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-outputThird Party Advisory

Timeline

Published: Oct 30, 2026
Last modified: Nov 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-119596.9Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input CVE-2026-1195915.5SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process CVE-2026-1195964.3UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to downlo CVE-2026-1195979.8OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator CVE-2026-1195984.3Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authentic CVE-2026-1195994.3AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creati CVE-2026-11965.3A security vulnerability has been detected in MineAdmin 1.x/2.x. Affected is an unknown function of the file /system/getFileInfoById. Such m CVE-2026-119606.9Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log CVE-2026-1196004.8tcpflow before 1.7.0 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending pa CVE-2026-1196016.1AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by sup CVE-2026-1196023.7libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to le CVE-2026-119618.1The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registr