# CVE-2026-119586: SQLite command-line shell .recover command injection

Source: https://junglewise.ai/threats/cve-2026-119586-sqlite-command-line-shell-through-3-54-1-contains-a-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119586 · Severity: high · CVSS 7.8 · Published 2026-10-30

SQLite's command-line tool contains a flaw in the .recover command used to restore corrupted databases. An attacker can craft a malicious database file that, when processed by the recovery command and piped to a new SQLite instance, executes arbitrary operating system commands with the privileges of the user running sqlite3. This allows code execution when a user attempts to recover from a damaged database.

Vendors: [SQLite](https://junglewise.ai/threats/vendors/sqlite).

## Quick answers

**Is CVE-2026-119586 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119586 being exploited in the wild.

**How severe is CVE-2026-119586?** High severity, with a CVSS score of 7.8, published 30 October 2026.

**Which products and versions are affected?** SQLite command-line shell through 3.54.1.

**Is there a fix for CVE-2026-119586?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-119586 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-119586?** Check whether you run SQLite command-line shell at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The .recover command in the SQLite CLI reconstructs CREATE statements from the sqlite_schema table but does not sanitize output; it emits attacker-planted SQL statements verbatim. An attacker can insert a valid CREATE statement followed by a dot-command (such as .shell or .system) into the schema. When the documented recovery pipe—piping .recover output into a second sqlite3 instance—is used, the second instance interprets the dot-commands as meta-commands and executes them at the operator's privilege level. This is a command injection vulnerability (CWE-78) triggered by user interaction with an untrusted database file.

## Affected products

- SQLite SQLite command-line shell through 3.54.1

## Timeline

- 2026-10-09: disclosed: Reported as 0-day by Abraxas Labs
- 2026-10-30: advisory: CVE-2026-119586 published

## References

- [https://sqlite.org/](https://sqlite.org/)
- [https://abraxaslabs.tech/research/sqlite-cli-recover](https://abraxaslabs.tech/research/sqlite-cli-recover)