Thank you for asking, sorry for the delay. As far as I can understand this vulnerability is not very dangerous for us. To exploit it external user should be able to run custom SQL queries, which is not osquery case, isn't it? If so, there is no rush for us to fix it. @Max gonna update sqlite version in master and experimental branch next week, but there will be no new release before holidays. Does it make sense?