openRuyi Lookout
← Packages

sqlite

autotoolsAdvisory

Library that implements an embeddable SQL database engine

Current
3.54.1
Candidate
Stale
License
LicenseRef-openRuyi-Public-Domain

Build

TargetResultLast successful versionSucceeded at
rva23
3.54.1
rva20
3.54.1
x86_64
3.54.1

Advisory · 1

Query product
sqliteNVD
Query vendor
sqliteNVD
Query version
3.54.1NVD

Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.

  • CVE-2026-119586
    NVD
    Summary
    SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.NVD
    EPSS model date
    2026-11-10FIRST
    EPSS probability
    1.54%FIRST
    Vulnerable CPE criteria
    cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*; <= 3.54.1NVD
    Aliases
    —NVD
    KEV
    NoCISA
    CVSS_V3
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HNVD
    CVSS_V4
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XNVD

Description

SQLite is a C library that provides an embedded SQL database engine. Each database is stored in a single file. No separate server is required. This build includes FTS3, FTS4, FTS5, R*Tree, Geopoly, dbstat, session changesets, and resumable bulk updates. It provides column metadata and unlock notifications. Secure deletion is enabled by default.

Changelog

PR · 9

Issue · 1

Checks
MonitorObservationLast checked
Source
Stale
Repository refresh: git fetch exited 128 (authentication)
Version
Stale
Source last confirmed at 2026-11-12T12:09:42+00:00; repository refresh overdue.
Build
Checked
GitHub
Checked
EOL
Checked
Current source cycle 3; upstream lifecycle only.
LicenseDiff
Not configured
No reliable monitor identity/configuration.
—
Dependencies
Not configured
No reliable monitor identity/configuration.
—
Advisory
Checked
Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated.
Last attempted
Yanked
Not configured
No reliable monitor identity/configuration.
—