Section 1.2 here might be a good start. https://www.sqlite.org/security.html

The Full Text Search extension (FTS) (FTS4?) has been a repeated source of issues.

If you stick with the core, and disable some of the shiny features, the track record is better. Though still not spotless, iirc.

It's a multi-hundred-thousand line project (current count, excluding tests, is about 210,000). Like any project of a similar size, it has a history of security vulnerabilities. OpenBSD removed it because it was too much code to audit. OpenBSD dodged several issues like this RCE (https://research.checkpoint.com/2019/select-code_execution-f...) as a result.

See https://www.cvedetails.com/vulnerability-list/vendor_id-9237...

Hundreds of thousands of lines of code are simply going to have vulnerabilities and bugs. It's unavoidable with that level of complexity. I'm skeptical anything that complicated is a wise choice for a general file format -- especially when smaller, simpler, and more easily debuggable and independently implementable formats exist.

I haven't taken the time to verify any of it, but a quick search for "sqlite code execution" doesn't look promising.