SQLite’s command‑line shell up to version 3.54.1 allows a .recover command to emit dot‑commands stored in the sqlite_schema.sql values verbatim. An attacker who can inject a CREATE statement followed by a .shell or .system line into a database schema can cause the shell to execute arbitrary OS commands when a victim pipes the .recover output into sqlite3. This results in arbitrary code execution, compromising confidentiality, integrity, and availability of the host system.

The vulnerability affects the SQLite:SQLite product, specifically releases up to 3.54.1 of the command‑line shell. No sub‑products or separate components are identified; the flaw resides in the core SQLite engine and its shell interface.

The CVSS score is 8.5, indicating high severity. The EPSS score is not available, but the lack of an official KEV listing does not diminish the potential impact. Likely attack vector is local: an adversary must be able to craft and supply a malicious database and invoke a sqlite3 session that pipes .recover output. The impact is the arbitrary execution of system commands. Based on the description, exploitation requires an environment where the victim runs the sqlite3 command against a controlled database, so the risk is higher for systems that automatically process untrusted SQLite databases.