Severity of this issue is high, no doubt, to exploit RCE attacker need to be able to execute arbitrary query in sqlite engine. osqueryi is the most affected part, but to be able to use exploit vulnerability attacker you need to be root on system already, since osqueryi will run in user space otherwise For osqueryd this is may be huge deal in case if you allow third party users to schedule query, which my be bad for different reasons, not only because of this RCE. I will branch master for this release and will push fixed sqlite next week, but can't commit for any date for binary release I need help from other people to do it.