8.5

CVE-2026-119586: SQLite CLI through 3.54.1 Command Injection via .recover Output

Analyzed
AliasesDEBIAN-CVE-2026-119586
Published 30-10-2026Last modified 30-10-2026

Vulnerability summary

CVE-2026-119586 is a high (CVSS 8.5) vulnerability in sqlite. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57.9% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
8.5/10
010
High · v4.0 (CVE.org)
EPSS score
0.84%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Timeline

  1. 30-10-2026
    PublishedVulnerability first disclosed.
  2. 30-10-2026
    Last modifiedVulnerability information updated.

Description

SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3.

CVSS metrics

5 scores · 3 sources · 2 versions

EPSS trend

Probability

0.84%

Chance of exploitation in the next 30 days

Percentile

58%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

31-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (abraxaslabs.tech)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Debian1 product
  • sqlite3All versions (No fix recorded)
Sqlite1 product

2 vendors · 2 products

References

6 links