Lack of Timely Updates from Azure CLI Team

“CVE-2026-11824,CVE-2026-11822 - Azure CLI bundles sqlite3.dll 3.50.4.0, below upstream security fix 3.53.2 ### Describe the bug Our vulnerability scanner detected an outdated SQLite library installed with Azure CLI for Windows: Path: C:\Program Files\Microsoft SDKs\Azure\CLI2\sqlite3.dll Installed file version: 3.50.4.0 Scanner remediation threshold: 3.53.2 The finding appears to correspond to SQLite vulnerabilities fixed upstream in SQLite 3.53.2, including CVE-2026-11822 and CVE-2026-11824, which affect the FTS5 extension in builds compiled with SQLITE_ENABLE_FTS5. Could the Azure CLI team please confirm if whether this is assessed as exploitable in Azure CLI and the planned Azure CLI version/ETA containing SQLite 3.53.2 or later. Thank you. For info: Scanner used: Nessus ```powershell PS C:\Users\> $cliDll = 'C:\Program Files\Microsoft SDKs\Azure\CLI2\sqlite3.dll' PS C:\Users\> Write-Output '=== Azure CLI SQLite DLL ===' === Azure CLI SQLite DLL === PS C:\Users\> Get-Item $cliDll | Select-Object ` >> FullName, >> Length, >> LastWriteTime, >> @{Name='FileVersion'; Expression = { $_.VersionInfo.FileVersion }}, >> @{Name='ProductVersion'; Expression = { $_.VersionInfo.ProductVersion }} FullName : C:\Program Files\Microsoft SDKs\Azure\CLI2\sqlite3.dll Length : 1584864 LastWriteTime : 6/10/2026 11:30:36 AM FileVersion : 3.50.4.0 ProductVersion : 3.50.4.0 PS C:\Users\> PS C:\Users\> Write-Output "`n=== SQLite DLL SHA-256 ===" === SQLite DLL SHA-256 === PS C:\Users\> Get-FileHash $cliDll -Algorithm SHA256 Algorithm Hash Path --------- ---- ---- SHA256 2940BEE51C4A00C7E8F2A8A1BE857D4C4AD23B2657FBF7FDF18E3A3FD20066C6 C:\Program Files\Microsoft SDKs\Azure\CLI2\sqlite3.dll PS C:\Users\> PS C:\Users\> Write-Output "`n=== Azure CLI Version ===" === Azure CLI Version === PS C:\Users\> az version { "azure-cli": "2.90.0", "azure-cli-core": "2.90.0", "azure-cli-telemetry": "1.1.0", "extensions": { "log-analytics": "1.0.0b1" } } PS C:\Users\> Write-Output "`n=== Windows OS ===" === Windows OS === PS C:\Users\> Get-CimInstance -ClassName Win32_OperatingSystem | >> Select-Object ` >> Caption, >> Version, >> BuildNumber, >> OSArchitecture, >> LastBootUpTime Caption : Microsoft Windows Server 2022 Datacenter Version : 10.0.20348 BuildNumber : 20348 OSArchitecture : 64-bit LastBootUpTime : 8/13/2026 5:30:06 AM PS C:\Users\> Write-Output "`n=== Windows Release Details ===" === Windows Release Details === PS C:\Users\> Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | >> Select-Object ` >> ProductName, >> DisplayVersion, >> CurrentBuildNumber, >> UBR, >> EditionID, >> InstallationType ProductName : Windows Server 2022 Datacenter DisplayVersion : 21H2 CurrentBuildNumber : 20348 UBR : 5499 EditionID : ServerDatacenter InstallationType : Server ``` ### Related command No commands related to this ### Errors No errors on the commands as this is flagged on a security scanner ### Issue script & Debug output N/A ### Expected behavior Vulnerability should be addressed. ### Environment Summary azure-cli 2.90.0 core 2.90.0 telemetry 1.1.0 Extensions: log-analytics 1.0.0b1 Dependencies: msal 1.36.0 azure-mgmt-resource 24.0.0 Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe' Config directory 'C:\Users\\.azure' Extensions directory 'C:\Users\\.azure\cliextensions' Python (Windows) 3.14.6 (tags/v3.14.6:c63aec6, Jun 10 2026, 10:26:10) [MSC v.1944 64 bit (AMD64)] Legal docs and information: a”