Read the docs
TI-2026-22711 Aliases CVE-2026-28438GHSA-59g6-v3vg-f7wc

CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

Priority LOW 36CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00323 25th percentileScored 2026-11-07
Fix Fixed cocoindex (cocoindex-io): 0.3.34cocoindex (PyPI): 0.3.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cocoindex-iococoindexbefore 0.3.340.3.34Patch availableCNA
—cocoindex (PyPI)before 0.3.340.3.34Patch availableGHSA-59g6-v3vg-f7wc
  • cocoindex Vendorcocoindex-io Affected before 0.3.34 Fixed in 0.3.34 Patch available CNA
  • cocoindex (PyPI) Vendor— Affected before 0.3.34 Fixed in 0.3.34 Patch available GHSA-59g6-v3vg-f7wc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cocoindex:cocoindex:*:*:*:*:*:*:*:*before 0.3.34VulnerableCocoindex
  • cpe:2.3:a:cocoindex:cocoindex:*:*:*:*:*:*:*:* Versions before 0.3.34 Vulnerable ·Cocoindex

Remediation

  • Fix · CNA cocoindex (cocoindex-io) Fixed in 0.3.34
  • Fix · GHSA-59g6-v3vg-f7wc cocoindex (PyPI) Fixed in 0.3.34 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28438
  2. 2026-10-03 Alias added: GHSA-59g6-v3vg-f7wc

References

Patch 1

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences