Read the docs
TI-2026-37724 Aliases CVE-2026-51936GHSA-7w4j-532w-pgpj

SQL injection in Zetetic SQLCipher

Priority LOW 18CWE-89Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
SQL injection
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the contents of one attached database into another. It is most often used to convert between plaintext and encrypted databases. It needs to do dynamic schema manipulation, and thus the function temporarily clears defensive restrictions during operation. A vulnerability in the handling of the source database name parameter made it possible for a caller to supply a crafted source name, which could execute statements that defensive mode would otherwise block. This could allow direct modifications to the sqlite_schema table and database corruption. SQLCipher 4.15.0 now strictly validates the source database name and prevents the bypass.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0018 7th percentileScored 2026-11-07
Fix Fixed SQLCipher (Zetetic): 4.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZeteticSQLCipherbefore 4.15.04.15.0Patch availableCNA
  • SQLCipher VendorZetetic Affected before 4.15.0 Fixed in 4.15.0 Patch available CNA

Remediation

  • Fix · CNA SQLCipher (Zetetic) Fixed in 4.15.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-51936
  2. 2026-10-03 Alias added: GHSA-7w4j-532w-pgpj

References

Other 2

  • TI-2021-02213 Zetetic SQLCipher 4.x before 4.4.3 has a NULL pointer dereferencing issue related to… CVSS 3.1HIGH 7.5
  • TI-2020-16536 Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences