# github.com/mattn/go-sqlite3@v1.14.52 security report (Go)

- Verdict: **Needs review** (risk level: medium)
- Scanned: 2026-10-05T19:09:17.000Z
- Files reviewed: 59
- Findings: 8 medium, 10 low severity findings
- Report: https://security.togoder.click/go/github.com/mattn/go-sqlite3
- Source: Togoder Security (https://security.togoder.click), AI source-code review

## Summary

Togoder Security scanned the Go package github.com/mattn/go-sqlite3@v1.14.52 on Oct 5, 2026. An AI review of 59 source files produced 8 medium, 10 low severity findings. The overall verdict is medium: the findings flag risky but common patterns (dynamic code, unsafe defaults, broad file or network access) rather than confirmed malware.

## Findings

### [medium] Dynamic native extension loading

Finding ID: `NPS-18B9273C3C26`

File: `_example/mod_vtable/extension.go:11`

The code registers a custom SQLite driver that loads the native extension 'sqlite3_mod_vtable'. Loading native extensions via 'Extensions: []string{}' allows arbitrary C code to be executed at runtime. If the extension binary is supplied by or tampered with by a malicious third-party package, this can lead to arbitrary code execution outside the Go sandbox.

### [medium] unsafe memory handling

Finding ID: `NPS-7E179F82C603`

File: `callback.go:36`

callbackTrampoline and stepTrampoline use unsafe.Pointer arithmetic to slice C array argv as a Go slice with length argc. If argc is negative or unexpectedly large, this could cause out-of-bounds access, memory corruption, and potential security issues. The assumption is that SQLite provides valid argc, but this is inherently unsafe Go/cgo boundary code.

### [medium] type assertion panic / DoS

Finding ID: `NPS-036C4B20F1A8`

File: `callback.go:37`

Multiple trampolines perform unchecked type assertions on values from lookupHandle (e.g., .(*functionInfo), .(func(string, string) int), etc.). If a handle is missing or misconfigured, these will panic and possibly crash the process. This is a reliability/DoS concern rather than malicious code.

### [medium] handle lifecycle memory issue

Finding ID: `NPS-161BABE83FB6`

File: `callback.go:128`

newHandle allocates C memory via C.malloc and stores a Go pointer in a sync.Map. lookupHandleVal returns a zero handleVal on missing handles, and preUpdateHookTrampoline calls hval.val.(func(SQLitePreUpdateData)) without checking nil, which could panic. deleteHandles also uses free on handles while other goroutines might still hold references, a potential use-after-free race.

### [medium] Loading of untrusted native code

Finding ID: `NPS-E719EE539097`

File: `sqlite3_load_extension.go:73`

The loadExtension function accepts a 'lib' string and CString-allocates it, then passes it to SQLite's extension loader. If a downstream application exposes this API to user-controlled data, it allows execution of arbitrary native code, which is a privilege escalation / code execution risk. This represents a potential attack surface rather than an intentional malicious pattern in the package itself.

### [medium] Dynamic native library loading

Finding ID: `NPS-26379EF3F73D`

File: `sqlite3_load_extension.go:79`

This file implements SQLite extension loading via sqlite3_load_extension, which dynamically loads arbitrary native shared libraries at runtime based on caller-provided paths. While this is the intended, documented feature of the package and is guarded by the sqlite_omit_load_extension build tag, it constitutes a code-loading capability that could be abused if the library path is influenced by untrusted input. It can load native code into the process, which is effectively a dynamic code execution path.

### [medium] Security compiler flags disabled

Finding ID: `NPS-AF43BD4BCA9E`

File: `sqlite3_windows.go:11`

The CFLAGS explicitly disable several compiler security mitigations: -fno-stack-check, -fno-stack-protector, and -mno-stack-arg-probe. These flags disable stack canaries, stack probing, and argument probing on Windows builds, which could make the resulting binary more vulnerable to memory corruption exploits. While common in some SQLite build configurations, disabling these protections is a security concern.

### [medium] Remote content extraction without integrity verification

Finding ID: `NPS-EC6E374FC67A`

File: `upgrade/upgrade.go:216`

The downloaded zip archive is extracted and its contents (sqlite3.c, sqlite3.h, sqlite3ext.h) are written directly into the package directory without any checksum, hash, or signature verification. A compromised upstream response or MITM attack could inject arbitrary C code into the generated amalgamation files that later get compiled into the package.

### [low] Fuzz harness writes to fixed path in /tmp

Finding ID: `NPS-DAD10E8B568E`

File: `_example/fuzz/fuzz_openexec.go:14`

FuzzOpenExec writes attacker-controlled input to the hardcoded path /tmp/fuzz.db before opening it as a SQLite database. Writing untrusted data to a predictable /tmp location can enable symlink or race-condition attacks and pollute a shared system directory. This is acceptable for a local fuzz target but is not safe if the function is invoked in other contexts.

### [low] Execution of attacker-controlled SQL

Finding ID: `NPS-6348649A5E0C`

File: `_example/fuzz/fuzz_openexec.go:28`

The function executes bytes from the input buffer as a SQL statement via db.Exec(). This is intentional behavior for a SQL fuzzer, but if the fuzz harness were ever exposed to untrusted callers outside of fuzzing, it would constitute arbitrary SQL execution against a database whose contents are also attacker-controlled.

### [low] Unchecked error handling leading to potentially misleading behavior

Finding ID: `NPS-D84688966372`

File: `_example/mod_vtable/extension.go:27`

The return values of 'db.Exec' and 'rows.Scan' are ignored. While not directly malicious, silently ignoring SQL execution errors could mask failures introduced by a malicious or modified extension, making detection of tampering harder.

### [low] SQL identifier construction

Finding ID: `NPS-840838C39BD0`

File: `_example/vtable/vtable.go:33`

The table name from args[2] is embedded into a CREATE TABLE statement after quote-escaping. While escaping is performed (doubling double-quotes), relying on string interpolation for DDL is fragile; a more robust approach uses parameterized/declared virtual table definitions. Low risk due to the escaping, but worth noting.

### [low] Suspicious network request

Finding ID: `NPS-D0E6512701E7`

File: `_example/vtable/vtable.go:65`

The Open() method makes an unauthenticated HTTP GET to https://api.github.com/repositories, fetching repository data at table-open time. While not inherently malicious, it is an external network call triggered whenever the virtual table is queried, which could be used for tracking/telemetry or unintended data retrieval. There is no rate limiting, retry logic, or user consent for network access.

### [low] Unbounded external data ingestion

Finding ID: `NPS-05B7AC8482B0`

File: `_example/vtable/vtable.go:73`

The entire HTTP response body is read into memory with ioutil.ReadAll and unmarshalled into a slice without size limits. A malicious or compromised endpoint (or MITM on non-TLS) could return a huge payload causing resource exhaustion, or malformed JSON causing denial of service.

### [low] External library dependency via cgo

Finding ID: `NPS-D1689525A033`

File: `sqlite3_libsqlite3.go:6`

The file uses cgo build directives to link against a system-provided libsqlite3 library rather than using a vendored version. While this is a common and legitimate pattern for the mattn/go-sqlite3 package, it introduces a dependency on whatever version of libsqlite3 is present on the host system. If an attacker can influence the library path or substitute a malicious libsqlite3, arbitrary code could be executed at load time. The hardcoded Homebrew paths for macOS amd64 and arm64 are standard for this package and not inherently malicious.

### [low] Dynamic library loading at build/import time

Finding ID: `NPS-C85C5DD3C7DE`

File: `sqlite3_libsqlite3.go:7`

The cgo LDFLAGS directives cause dynamic linking to libsqlite3 at build time. This is expected behavior for this build tag and not a malicious pattern, but it does mean the resulting binary loads external native code at runtime. No obfuscation, exfiltration, or suspicious behavior is present in the file itself.

### [low] Network request to external host

Finding ID: `NPS-8B7495FC8BDB`

File: `upgrade/upgrade.go:20`

The code downloads the SQLite download page and a SQLite amalgamation archive from https://www.sqlite.org over HTTP without TLS certificate verification logic. While this is the legitimate SQLite project domain, it is still a hardcoded external network dependency at build time.

### [low] File system writes outside typical build scope

Finding ID: `NPS-AC3BAE0DB3CB`

File: `upgrade/upgrade.go:218`

The extraction loop writes files (sqlite3-binding.c, sqlite3-binding.h, sqlite3ext.h) into filepath.Dir(filepath.Dir(file)), the parent directory of the upgrade package. This modifies files outside the immediate package scope.

## Files reviewed

- `_example/fuzz/fuzz_openexec.go` (medium): No malicious exfiltration or backdoor patterns detected; the code is a legitimate go-sqlite3 fuzz harness that writes to a fixed /tmp path and executes attacker-supplied SQL by design.
- `_example/mod_vtable/extension.go` (medium): The example code loads a native SQLite extension dynamically, which introduces a non-trivial risk of arbitrary code execution if that extension is supplied or substituted by an untrusted package, but no direct exfiltration, credential harvesting, or obfuscation is present.
- `_example/vtable/vtable.go` (medium): Sample vtable code makes an unauthenticated external GitHub API call at query time and reads the full response without limits, but contains no exfiltration, credential harvesting, code execution, or backdoor patterns.
- `callback.go` (medium): This is legitimate cgo glue code for SQLite custom functions from the go-sqlite3 driver; it contains no malicious patterns, but it relies on unsafe pointers, unchecked type assertions, and C memory management that could cause memory safety issues if inputs are malformed.
- `sqlite3_libsqlite3.go` (medium): The file is a standard cgo build-tag shim for linking against the system libsqlite3; it contains no malicious code, though its reliance on external dynamic libraries is a minor supply-chain consideration.
- `sqlite3_load_extension.go` (medium): The code implements a documented SQLite extension-loading capability that dynamically loads native shared libraries; this is an expected feature guarded by a build tag, but it is a powerful code-loading primitive that warrants caution when exposed to untrusted input. No data exfiltration, credential harvesting, obfuscation, or backdoor patterns were found.
- `sqlite3_windows.go` (medium): This Windows-specific Go cgo file disables stack protection compiler flags, which weakens binary hardening, but no malicious patterns such as data exfiltration, credential harvesting, or backdoor installation were detected.
- `upgrade/upgrade.go` (medium): This is a legitimate-looking SQLite amalgamation upgrade tool that downloads the official SQLite archive and extracts source files into the package, but lacks integrity verification of the downloaded content, creating a potential supply-chain risk.
- `_example/custom_driver_name/main.go` (safe): No malicious patterns detected
- `_example/custom_func/main.go` (safe): Cleared by Jev triage; no further analysis needed
- `_example/hook/hook.go` (safe): No malicious patterns detected
- `_example/json/json.go` (safe): No malicious patterns detected
- `_example/limit/limit.go` (safe): No malicious patterns detected
- `_example/mod_regexp/extension.go` (safe): No malicious patterns detected; the code is a standard example demonstrating SQLite regexp extension usage.
- `_example/simple/simple.go` (safe): No malicious patterns detected
- `_example/trace/main.go` (safe): No malicious patterns detected; the code is a straightforward SQLite tracing example with no network, file, or process manipulation.
- `_example/vtable/main.go` (safe): Example code demonstrating Go SQLite virtual table usage; no malicious patterns detected.
- `_example/vtable_eponymous_only/main.go` (safe): No malicious patterns detected in this example Go file, which demonstrates legitimate use of the go-sqlite3 driver with a custom module.
- `_example/vtable_eponymous_only/vtable.go` (safe): This is a standard SQLite virtual table module implementation with no malicious patterns; it only generates integer sequences and does not perform network, filesystem, process, or dynamic execution operations.
- `backup.go` (safe): No malicious patterns detected; this is a legitimate SQLite backup wrapper using standard cgo bindings with proper memory management and error handling.
- `convert.go` (safe): Cleared by Jev triage; no further analysis needed
- `doc.go` (safe): No malicious patterns detected; the file is purely documentation for the go-sqlite3 driver and contains no executable code, network activity, credential access, or other security concerns.
- `error.go` (safe): No malicious patterns detected; the file defines SQLite error constants and error handling types with no network, filesystem, process, or dynamic execution behavior.
- `sqlite3.go` (safe): This is the legitimate mattn/go-sqlite3 SQLite driver with cgo bindings and normal database operations, containing no malicious patterns such as data exfiltration, credential harvesting, obfuscated code, or network backdoors.
- `sqlite3_context.go` (safe): No malicious patterns detected; the file contains standard SQLite result-setting wrapper functions with no network, filesystem, process, or obfuscation activities.
- `sqlite3_func_crypt.go` (safe): Cleared by Jev triage; no further analysis needed
- `sqlite3_load_extension_omit.go` (safe): No malicious patterns detected
- `sqlite3_opt_allow_uri_authority.go` (safe): No malicious patterns detected; the file only defines build tags and cgo flags for SQLite URI authority support.
- `sqlite3_opt_app_armor.go` (safe): No malicious patterns detected; the file only sets a build tag and C compiler flags for SQLite API armor.
- `sqlite3_opt_column_metadata.go` (safe): No malicious patterns detected
- `sqlite3_opt_dbstat.go` (safe): No malicious patterns detected
- `sqlite3_opt_foreign_keys.go` (safe): The file only contains build tags and cgo directives for SQLite default foreign key support with no malicious patterns.
- `sqlite3_opt_fts5.go` (safe): No malicious patterns detected; the file only contains standard build tags and cgo directives to enable SQLite FTS5 support.
- `sqlite3_opt_icu.go` (safe): No malicious patterns detected
- `sqlite3_opt_introspect.go` (safe): No malicious patterns detected
- `sqlite3_opt_math_functions.go` (safe): The file only contains build-tag-guarded cgo directives to enable SQLite math functions and link libm; no malicious patterns detected.
- `sqlite3_opt_os_trace.go` (safe): No malicious patterns detected; the file only defines build-tag-gated C compiler flags for SQLite OS tracing.
- `sqlite3_opt_percentile.go` (safe): No malicious patterns detected
- `sqlite3_opt_preupdate.go` (safe): Cleared by Jev triage; no further analysis needed
- `sqlite3_opt_preupdate_hook.go` (safe): No malicious patterns detected; the code implements a legitimate SQLite pre-update hook interface using cgo, with no exfiltration, credential harvesting, obfuscation, or suspicious behavior.
- `sqlite3_opt_preupdate_omit.go` (safe): Cleared by Jev triage; no further analysis needed
- `sqlite3_opt_secure_delete.go` (safe): No malicious patterns detected
- `sqlite3_opt_secure_delete_fast.go` (safe): No malicious patterns detected
- `sqlite3_opt_serialize.go` (safe): No malicious patterns detected
- `sqlite3_opt_serialize_omit.go` (safe): No malicious patterns detected; the file only contains build-tag-gated stubs that return errors when the sqlite_serialize feature is unavailable.
- `sqlite3_opt_stat4.go` (safe): No malicious patterns detected; the file is a standard Go cgo build-tag configuration for enabling SQLite STAT4.
- `sqlite3_opt_unlock_notify.go` (safe): No malicious patterns detected; the code is a legitimate CGO-based SQLite unlock-notify helper with no data exfiltration, credential harvesting, obfuscation, or process execution.
- `sqlite3_opt_userauth.go` (safe): This file contains only stubbed-out functions for a deprecated SQLite user authentication feature; the real implementations have been removed and no malicious patterns, network calls, or dynamic execution are present.
- `sqlite3_opt_userauth_omit.go` (safe): The code is a build-tag-gated stub implementation of user authentication functions for a SQLite driver, containing only no-op returns with no malicious patterns.
- `sqlite3_opt_vacuum_full.go` (safe): No malicious patterns detected
- `sqlite3_opt_vacuum_incr.go` (safe): No malicious patterns detected
- `sqlite3_opt_vtable.go` (safe): No malicious patterns detected
- `sqlite3_other.go` (safe): No malicious patterns detected
- `sqlite3_solaris.go` (safe): No malicious patterns detected; the file contains only build constraints and cgo directives for Solaris compatibility.
- `sqlite3_sql.go` (safe): Cleared by Jev triage; no further analysis needed
- `sqlite3_trace.go` (safe): No malicious patterns detected; the code is a legitimate SQLite trace callback implementation from the mattn/go-sqlite3 driver.
- `sqlite3_type.go` (safe): No malicious patterns detected; the code only performs SQLite column type mapping and contains no network, filesystem, process, or dynamic execution behavior.
- `sqlite3_usleep_windows.go` (safe): No malicious patterns detected; the file contains a legitimate C helper for implementing usleep via a Windows waitable timer.
- `static_mock.go` (safe): No malicious patterns detected; the file is a legitimate stub for when cgo is disabled and contains no harmful behavior.

AI analysis is guidance, not a guarantee. Methodology: https://security.togoder.click/methodology