Update sqlite to 3.50.2 to mitigate CVE-2025-6965 #100

Activity

1. SkowronskiAndrew commented on Jul 17, 2026

   

   SkowronskiAndrew

   on Jul 17, 2026

   Last edited by SkowronskiAndrew

   Collaborator

   More actions

   Thanks luan-mont for the report.

   I asked Claude to do a deep dive investigation as the package versioning is pretty confusing. Summary is that it confirms the underlying advisory is valid, with some corrections to the version details:

   Confirmed affected. UnityDataTools currently references Microsoft.Data.Sqlite 9.0.1 (in Analyzer.csproj and ReferenceFinder.csproj). That resolves transitively to SQLitePCLRaw.lib.e_sqlite3 2.1.10, which bundles SQLite engine 3.46.1 — earlier than the 3.50.2 fix for CVE-2025-6965. So the flawed engine is indeed present.

   A note on the version numbers. The phrasing "fixed in SQLitePCLRaw.lib.e_sqlite3 starting at 3.50.2" mixes two different versioning schemes. In the legacy 2.1.x line, the package version is not the SQLite engine version (2.1.10 → SQLite 3.46.1; 2.1.11 → SQLite 3.49.1, still affected). Only the newer v3 line of SQLitePCLRaw versions the package to track the SQLite engine directly. So the target to aim for is SQLite engine ≥ 3.50.2, regardless of the wrapper package's own version number.

   Bumping Microsoft.Data.Sqlite alone is not sufficient. The current latest on our .NET 9 line (9.0.18) still declares only SQLitePCLRaw.bundle_e_sqlite3 >= 2.1.11, and NuGet resolves that floor to 2.1.11 = SQLite 3.49.1, which is still affected. Clearing the CVE requires an explicit direct PackageReference pinning the SQLitePCLRaw native package to a build carrying SQLite ≥ 3.50.2, then verifying the resolved transitive version with dotnet list package --include-transitive.

   Practical risk for this tool is low. The CVE's network-attack scoring assumes an application executing attacker-controlled SQL. UnityDataTools is a local CLI that builds its own SQLite databases from Unity build output and runs its own queries — it does not accept untrusted SQL over a network. We'll patch it as good hygiene and to clear dependency scanners, but there's no exposure to remote exploitation in normal use.

   We'll also validate the double-quoted-string-literal compatibility caveat you raised as part of the upgrade.
2. SkowronskiAndrew

   added a commit that references this issue on Sep 15, 2026

   [#100] Update SQLite to 3.53.3 to mitigate CVE-2025-6965 (#133)

   ...

   f04ccb7
3. SkowronskiAndrew

   closed this as completedin #133on Sep 15, 2026