CVE-2026-28438
CRITICALCocoIndex < 0.3.34 - SQL Injection via Doris Target Connector Table Name
Title source: llmDescription
CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://github.com/cocoindex-io/cocoindex/security/advisories/GHSA-59g6-v3vg-f7wc
Scores
CVSS v3
9.8
EPSS
0.0005
EPSS Percentile
14.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-89
Status
published
Products (2)
cocoindex/cocoindex
< 0.3.34
pypi/cocoindex
0 - 0.3.34PyPI
Published
Mar 06, 2026
Tracked Since
Mar 06, 2026