A vulnerability in Diesel's SQLite backend arises from incorrect assumptions about UTF-8 encoding when deserializing query results. Diesel used the sqlite3_value_text function assuming it always returns valid UTF-8 strings, but for SQLite BLOB types, this can contain arbitrary bytes, violating Rust's string safety guarantees. This issue is fixed in Diesel version 2.3.8.