logoalt Hacker News

mynameisashyesterday at 5:31 PM1 replyview on HN

> Curl has a well earned reputation for high quality code.

SQLite also has a very good reputation. I vaguely recall hearing about one SQLite vulnerability discovered via AI, but I thought it turned out to be a nothingburger. A quick search turned up CVE-2025-6965[0,1], published on 2025-07-15, which affects SQLite < 3.50.2 (versions published before 2025-05-29[2]).

I'm not much of a security nerd, but my naive reading of this implies that it was already known and fixed as of the time of the CVE; in other words, the AI discovery didn't seem particularly helpful (though one could argue that it did successfully discover a CVE).

Has AI found many/any other vulnerabilities in SQLite?

[0] https://cybersecuritynews.com/sqlite-0-day-vulnerability/

[1] https://nvd.nist.gov/vuln/detail/cve-2025-6965

[2] https://sqlite.org/releaselog/3_50_2.html


Replies

bluGillyesterday at 5:57 PM

Hard to say what AI has been used in SQLite unless someone is talking. My impression is the maintainer doesn't talk about this type of thing much, but maybe I'm wrong.