JFrog finds 54 fake SQLite CVEs from one GitHub account

JFrog found that 54 of 55 SQLite CVE advisories from one GitHub account were fabricated, the security firm said. Fed into an autonomous remediation agent, one of these fakes won't get caught. The agent will locate the named function, write a patch, and commit a real code change to fix a bug that was never there.

The cited code didn't exist in the named SQLite versions. The proof-of-concept payloads didn't trigger the crashes they claimed to cause, and none of the 54 showed up on SQLite's own advisory page.

MITRE's CVE submission process doesn't verify who's filing, per JFrog. Anyone can register a GitHub account and publish an advisory citing specific functions and line numbers that were never in the codebase. It lands in the same public database as confirmed vulnerabilities, with no gate that checks the claim against the vendor's own record first.

A human triager might notice the PoC doesn't crash anything. An agent built to patch first and verify later just ships the fix.

JFrog's finding covers one account and 55 advisories. There's no count yet for how many other fabricated entries sit in the same database, waiting for an agent to act on them.