[Resolved] Security issue: Microsoft Learn article uses vulnerable sqlite-net-pcl dependency

[stephenquan]

While following the Microsoft Learn article .NET MAUI local databases developers are instructed to install the sqlite-net-pcl NuGet package. However, the current stable version (1.9.172) introduces a high‑severity security vulnerability via transitive dependencies:

• sqlite-net-pcl/1.9.172:
  • SQLitePCLRaw.bundle_green/2.1.2
    • SQLitePCLRaw.lib.e_sqlite3/2.1.2 (vulnerable)

During build, this results in warnings such as:

warning NU1903: Package 'SQLitePCLRaw.lib.e_sqlite3' 2.1.2 has a known high severity vulnerability, GHSA-2m69-gcr7-jv3q

Workarounds

At the time of writing, there is no stable release in the dependency chain that fully resolves this issue. Possible mitigations include:

• Upgrading to a prerelease version such as: sqlite-net-pcl/1.11.272-beta
• Switching to SourceGear.sqlite3/3.50.4.5

Recommendation

Given that the official Microsoft Learn article still references sqlite-net-pcl without any warning, it would be helpful to:

• Highlight this vulnerability
• Recommend a safe version or mitigation approach

This would help developers avoid introducing a known high‑severity vulnerability into their applications.

[pictos]

Hey @stephenquan, the docs are open source. If you want and have time you can contribute fixing it, just click in Edit (the image below show how)

And you be redirect into the gihub repo and file for that doc

[stephenquan]

@pictos okay, I guess I'll get Copilot to help generate a warning box and submit it for review.

[stephenquan]

https://www.nuget.org/packages/sqlite-net-pcl/1.11.285 just got released which resolves the security vulnerabilities.