SQLite vulnerbilities

[NiKiZe]

Microsoft.Data.Sqlite seem to still have dependencies on known vulnerable versions of SQLite.

1. Could we get the vulnerable versions marked as vulnerable please!?
2. Can we get updated versions which are not vulnerable!?
3. If we can't get updated versions please provide explanations, but still do 1!

2025-07-15 CVE-2025-6965 GHSA-2m69-gcr7-jv3q
2026-03-13 CVE-2025-70873 GHSA-p36r-6g67-869c (this one still does not mention the nuget packages)
2026-05-12 This issue created
2026-05-13 Multiple attempts at reporting this to MSRC
2026-06-17 GHSA-2m69-gcr7-jv3q Updated with the package

[akoeplinger]

Microsoft.Data.Sqlite lives in dotnet/efcore repo, transferring issue.

[NiKiZe]

Microsoft.Data.Sqlite lives in dotnet/efcore repo, transferring issue.

Then maybe... fix the link on https://www.nuget.org/packages/microsoft.data.sqlite/ ?

[akoeplinger]

You mean the "Source repository" link? that's actually technically correct since the sources are built out of the .NET Virtual Monolithic Repository (VMR) repo in dotnet/dotnet so that's what NuGet's source link is based off of.
This blog post also has all the details about the VMR in case you're curious: https://devblogs.microsoft.com/dotnet/how-we-synchronize-dotnets-virtual-monorepo/

I agree it can be a bit confusing, let me see if there's something we can do about it.

[AndriySvyryd]

@NiKiZe Which versions of Microsoft.Data.Sqlite dependencies are vulnerable?

[NiKiZe]

SQLitePCLRaw.bundle_e_sqlite3 (>= 2.1.11)
...
SQLitePCLRaw.lib.e_sqlite3 (>= 2.1.11) deprecated

CVE-2025-6965 all versions before 3.50.2 is vuln.
Please make sure that all vuln versions in nuget gets marked as such,
If you need help with identifying these, I think Windows Defender Endpoint protection will do the job of identifying them.

There is also CVE-2025-70873 with versions before 3.51.2 being vuln.
I think MS should take responsibility here and make sure that Microsoft.Data.Sqlite directly pulls in non vuln version of the native lib and not trust SQLitePCLRaw to do that.

[NiKiZe]

You mean the "Source repository" link? that's actually technically correct since the sources are built out of the .NET Virtual Monolithic Repository (VMR) repo in dotnet/dotnet so that's what NuGet's source link is based off of.

Everyone assumes that the link to sources is the sources AND the place to report issues. Move the sources to this repo, or have issues be reported where the sources is located, DO NOT require a disconnect!, I should not, and will not read a blog to open issues in the right place or find the sources.

[AndriySvyryd]

Please make sure that all vuln versions in nuget gets marked as such

The vulnerability is in SQLitePCLRaw packages so they are the ones that should be marked as such, please report it on https://msrc.microsoft.com/report/vulnerability/new

I think MS should take responsibility here and make sure that Microsoft.Data.Sqlite directly pulls in non vuln version of the native lib and not trust SQLitePCLRaw to do that.

Is there a non vulnerable version available on NuGet that Microsoft.Data.Sqlite can depend on?

[NiKiZe]

Please make sure that all vuln versions in nuget gets marked as such

The vulnerability is in SQLitePCLRaw packages so they are the ones that should be marked as such, please report it on https://msrc.microsoft.com/report/vulnerability/new

I did, got a response that they wont do anything about it (I'm more than a little angry about that)
But all versions of Microsoft.Data.Sqlite indirectly pulls in a vuln version of SQLite, so they should all be marked vulnarble, If you would have said this when the CVEs was published that would have been fine, but now there is still no updated version, several months later, even tho MS own product (Defender) screams about it. We find it odd that this hasn't been picked up and fixed earlier. - But I do appreciate if we can get updated 10.x and at least 8.x builds out with the dependencies updated.

I think MS should take responsibility here and make sure that Microsoft.Data.Sqlite directly pulls in non vuln version of the native lib and not trust SQLitePCLRaw to do that.

Is there a non vulnerable version available on NuGet that Microsoft.Data.Sqlite can depend on?

Yes, SQLitePCLRaw.bundle_e_sqlite3 to 3.0.3
Right now we have to add this manually as a reference to get non vuln libs in projects.

[AndriySvyryd]

But I do appreciate if we can get updated 10.x and at least 8.x builds out with the dependencies updated.

Updating SQLitePCLRaw.bundle_e_sqlite3 dependency to v3 would be a breaking change, this isn't something we can do in a patch

Yes, SQLitePCLRaw.bundle_e_sqlite3 to 3.0.3

SQLitePCLRaw.bundle_e_sqlite3 v3.0.3 depends on SourceGear.sqlite3 v3.50.4.5, so it doesn't have the CVE-2025-70873 fix

[NiKiZe]

But I do appreciate if we can get updated 10.x and at least 8.x builds out with the dependencies updated.

Updating SQLitePCLRaw.bundle_e_sqlite3 dependency to v3 would be a breaking change, this isn't something we can do in a patch

What kind of breaking change, since anyone that tries to work around the CVEs are updating anyway?
So you prefer to have a vulnerable package instead? Based on how much else MS is breaking this would be kind of minor..
Regardless, again, then mark all current packages as vulnerable, because it is unacceptable that these are distributed!

Yes, SQLitePCLRaw.bundle_e_sqlite3 to 3.0.3

SQLitePCLRaw.bundle_e_sqlite3 v3.0.3 depends on SourceGear.sqlite3 v3.50.4.5, so it doesn't have the CVE-2025-70873 fix

Yes, that is why I said that you should take responsibility and pull in the packages directly so SQLitePCLRaw.bundle_e_sqlite3 v3.0.3 and then latest SourceGear.sqlite3 since SQLitePCLRaw officially say they will no longer update dependencies, and that they provide a payd service if you want up2date package feed.