Threats tagged 'ghsa-2h5x-4qp8-353h'

SQLite command-line shell versions through 3.54.1 have a command injection vulnerability in the .recover command. This flaw allows attackers to craft a database schema containing malicious dot-commands such as .shell or .system, which are emitted verbatim by the .recover command. When a victim pipes the output of .recover into sqlite3, these commands execute arbitrary OS commands.