Package "C1.Win.FlexReport": vulnerability warning due to "SQLitePCLRaw"

Package "C1.Win.FlexReport": vulnerability warning due to "SQLitePCLRaw"

Posted by: wknauf on 24 June 2026, 5:28 am EST

• 

  wknauf

  • Post Options:
  • Link
    Copy
  • Jump To Answer

  Posted 24 June 2026, 5:28 am EST

  Just upgraded our app to .NET10 and found this warning for the project that has a package reference to “C1.Win.FlexReport” 10.0.20261.779:

  Package 'SQLitePCLRaw.lib.e_sqlite3' 2.1.10 has a known high severity vulnerability, https://github.com/advisories/GHSA-2m69-gcr7-jv3q

  This is a indirect dependency from “Microsoft.Data.Sqlite”, which you currently reference with version 9.0.5, but the warning appears also with recent 10.0.9.

  Attached is a sample project:
  
  FlexReportNet10.zip

  Seems this is nothing that you can fix, Microsoft would first have to release a new “Microsoft.Data.Sqlite”: https://github.com/dotnet/efcore/issues/38257

  The developers probably noticed it already, and it was probably also reported by other customers, but I don’t see forum posts about this.

  Workaround: add this to the csproj file that references “C1.Win.FlexReport”:

  <ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
  </ItemGroup>

  Or better (in a multi project solution) add a file “Directory.Build.props” to the solution root directory with this content:

  <Project>
    <ItemGroup>
      <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
    </ItemGroup>
  </Project>
  

  If Microsoft releases an update to “Microsoft.Data.Sqlite”, I assume you have to update your own package reference to the fix version.

  Best regards

  Wolfgang

• 

  wknauf

  • Post Options:
  • Link
    Copy

  Posted 24 June 2026, 6:00 am EST

  Just to clarify: we don’t use SQLite access, so it is fine for us to just suppress the warning.

• 

  uttkarsh.matiyal

  

  • Post Options:
  • Link
    Copy

  Posted 25 June 2026, 1:48 am EST

  Hello Wolfgang,

  Thank you for reporting this issue and providing a detailed breakdown alongside your sample project.
  
  Your analysis is completely correct. The high-severity warning (GHSA-2m69-gcr7-jv3q) originates within the transitive dependency SQLitePCLRaw.lib.e_sqlite3, a dependency of Microsoft.Data.Sqlite.
  
  We have escalated this to our development team so they can monitor Microsoft’s upcoming patches and update our package dependencies as soon as a fix is available. [Internal Tracking ID: C1WIN-35438]\

  Regards,
  
  Uttkarsh.

• 

  uttkarsh.matiyal

  

  • Post Options:
  • Link
    Copy

  Posted 15 July 2026, 1:29 am EST

  Hello Wolfgang,

  The issue has been fixed in the latest 2026v1 Hotfix 1 (796) release. Please upgrade the C1.Win.FlexReport NuGet package to v10.0.20261.796 to resolve the issue.

  Regards,
  
  Uttkarsh.

• 

  wknauf

  • Post Options:
  • Link
    Copy

  Posted 15 July 2026, 7:49 am EST - Updated 15 July 2026, 7:55 am EST

  Thanks, I can confirm that the warning is gone even after removing the suppression.

  Seems you updated the package yourself instead of waiting for a Microsoft fix:
  
  

  Best regards

  Wolfgang