Every CVE Search/ Get API key

CVE-2026-28438

CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

6.9 MediumFix available

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.32%Up 0.3 points since Mar 6, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.

Record
CVE-2026-28438
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2026-10005 6.9

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.

Record
EUVD-2026-10005
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-59g6-v3vg-f7wc 8.0

CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

Impact

The Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change.

Patches

Yes, it's fixed in cocoindex 0.3.34: we start to validate table names passed to Doris target at entry point and error out immediately if it's not a valid identifier.

Workarounds

Users should make sure table names used to configure CocoIndex targets are valid, regardless of this fix. Which means

  • The table name comes from a trusted source (e.g. for most cases it's just a fixed string literal).
  • Even if it comes from an untrusted source (e.g. provided by end user), it should be validated before using it to configure the Doris target for CocoIndex.
Record
GHSA-59g6-v3vg-f7wc
CVSS 4.0
8.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-89
Updated
2026-11-02
NVD 6.9

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.

Record
CVE-2026-28438
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSV 6.9

CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.

Record
CVE-2026-28438
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-89
Updated
2026-11-02
OSVGHSA-59g6-v3vg-f7wc 8.0

CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

Impact

The Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change.

Patches

Yes, it's fixed in cocoindex 0.3.34: we start to validate table names passed to Doris target at entry point and error out immediately if it's not a valid identifier.

Workarounds

Users should make sure table names used to configure CocoIndex targets are valid, regardless of this fix. Which means

  • The table name comes from a trusted source (e.g. for most cases it's just a fixed string literal).
  • Even if it comes from an untrusted source (e.g. provided by end user), it should be validated before using it to configure the Doris target for CocoIndex.
Record
GHSA-59g6-v3vg-f7wc
CVSS 4.0
8.0 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-89
Updated
2026-11-02
OSVPYSEC-2026-2133 9.8

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.

Record
PYSEC-2026-2133
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cocoindex
PyPI
 before 0.3.34
0.3.34
cocoindex
PyPI
 before 0.3.34, plus listed versions
0.1.430.1.440.1.450.1.460.1.47
Show 45 moreShow less
0.1.480.1.490.1.500.1.510.1.520.1.530.1.540.1.550.1.560.1.570.1.580.1.590.1.600.1.610.1.620.1.630.1.640.1.650.1.660.1.670.1.680.1.690.1.700.1.710.1.720.1.730.1.740.1.750.1.760.1.770.1.780.1.790.1.800.1.810.1.820.1.830.2.00.2.10.2.100.2.110.2.120.2.130.2.140.2.150.2.16
0.3.34

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-28438 is a medium vulnerability (CVSS 6.9) in Cocoindex, published March 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in cocoindex 0.3.34.

References

This page doesn't list everything

Left out here: 49 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open