EUVD lists SQLite shell command injection in .recover (EUVD-2026-113834)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- SQLite
- Product
- SQLite command-line shell
- First seen
Summary
The EUVD entry EUVD-2026-113834, shared in a Mastodon post, describes a command injection flaw in the .recover command of the SQLite command-line shell through 3.54.1. It rates the flaw 8.5/10 (CVSS v3.1) and says a crafted database schema can inject dot-commands.
If you use SQLite
Identify systems running the SQLite CLI version 3.54.1 or earlier.
Update the SQLite shell to a fixed release.
Avoid running .recover on database files from untrusted sources.
Check whether your SQLite version is earlier than 3.54.0.
Update SQLite to 3.54.0 or later.
Limit query complexity and reject untrusted SQL where possible.
What the sources say 11
· Mastodon: “SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause.” Source
· Mastodon: “SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim.” Source
· Mastodon: “SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets.” Source
· Mastodon: “SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table.” Source
· Mastodon: “SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column.” Source
· Mastodon: “SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators.” Source
· Mastodon: “SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size.” Source
· Mastodon: “SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets.” Source
· Mastodon: “SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists.” Source
· Mastodon: “SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers.” Source
· Mastodon: “SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it.” Source