Hi,
In Visual Studio, I'm getting vulnerability alerts for package 'SQLitePCLRaw.lib.e_sqlite3' which is used by multiple Telerik Products:
https://github.com/advisories/GHSA-2m69-gcr7-jv3q
I understand i'm running old version of packages, but i updated to 20.1.26.615 and made no difference.
1 Answer, 1 is accepted
Hello Lee,
We are aware of the NuGet audit findings, please carefully read and follow the guidance in this KB article => Telerik Reporting SQLitePCLRaw.lib.e_sqlite3 Has a Vulnerable Dependency on SQLite (CVE-2025-6965) - Telerik Reporting
While we have not identified an exploitable vector related to this dependency in the context of Telerik Reporting so far, we are planning to address the underlying dependency as part of an upcoming release, currently targeting next week.
Regards,
Lance | Senior Manager Technical Support
Progress Telerik
Love the Telerik and Kendo UI products and believe more people should try them? Invite a fellow developer to become a Progress customer and each of you can get a $50 Amazon gift voucher.
Rank 1
Hi, Version 3 of
SQLitePCLRaw.lib.e_sqlite3
Has been out for some time. When do you think Telerik will update to a version that removes this vunerability?
https[://]github.com/ericsink/SQLitePCL.raw/releases
Hello Everyone,
I'm replying to let you know that we have addressed this issue in today's release => Release Notes: v20.1.26.707.
If you have any issues upgrading Telerik Reporting in your project(s) or have any other concerns, please open a new Technical Support ticket so the Reporting team can assist you further.
Thank you again for your patience and understanding!
Adding an additional comment here for more visibility. This dependency was replaced in today's release, see Release Notes: v20.1.26.707 Once you update to 20.1.26.707 or later, this transitive dependency warning will no longer appear.