CVE-2026-28438

CRITICAL

CocoIndex < 0.3.34 - SQL Injection via Doris Target Connector Table Name

Title source: llm
STIX 2.1

Description

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.

Scores

CVSS v3 9.8
EPSS 0.0005
EPSS Percentile 14.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (2)
cocoindex/cocoindex < 0.3.34
pypi/cocoindex 0 - 0.3.34PyPI
Published Mar 06, 2026
Tracked Since Mar 06, 2026