SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://sqlite.org/forum/forumpost/07beac8056151b2f Exploit, Issue Tracking, Vendor Advisory
- https://sqlite.org/src/info/cefc032473ac5ad2 Patch, Vendor Advisory
- https://sqlite.org/forum/forumpost/07beac8056151b2f Exploit, Issue Tracking, Vendor Advisory
- https://sqlite.org/src/info/cefc032473ac5ad2 Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.3 · sqliteNVD modified 2026-10-14 19:16
Affected (CPE criteria) 1
cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*
References 12
- https://news.ycombinator.com/item?id=33948588 Exploit, Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/202311-03
- https://security.netapp.com/advisory/ntap-20230203-0005/ Third Party Advisory
- https://sqlite.org/forum/forumpost/07beac8056151b2f Exploit, Issue Tracking, Vendor Advisory
- https://sqlite.org/src/info/cefc032473ac5ad2 Patch, Vendor Advisory
- https://news.ycombinator.com/item?id=33948588 Exploit, Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/202311-03
- https://security.netapp.com/advisory/ntap-20230203-0005/ Third Party Advisory
- https://sqlite.org/forum/forumpost/07beac8056151b2f Exploit, Issue Tracking, Vendor Advisory
- https://sqlite.org/src/info/cefc032473ac5ad2 Patch, Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-556635.html