CVE-2025-59037

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59037
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59037.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59037
Aliases
Published
2025-09-09T20:26:57.986Z
Modified
2026-04-02T12:57:18.886418Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
Details

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packages that included malicious code to interfere with cryptocoin transactions* According to the npm statistics, nobody has downloaded these packages before they were deprecated. The packages and versions @duckdb/node-api@1.3.3, @duckdb/node-bindings@1.3.3, duckdb@1.3.3, and @duckdb/duckdb-wasm@1.29.2 were affected. DuckDB immediately deprecated the specific versions, engaged npm support to delete the affected verions, and re-released the node packages with higher version numbers (1.3.4/1.30.0). Users may upgrade to versions 1.3.4, 1.30.0, or a higher version to protect themselves. As a workaround, they may also downgrade to 1.3.2 or 1.29.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59037.json",
    "cwe_ids": [
        "CWE-506"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/duckdb/duckdb-node

Affected ranges

Type
GIT
Repo
https://github.com/duckdb/duckdb-node
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e5471e09f013f9d59321dc1a7dcdf163ff613783

Affected versions

v0.*
v0.0.1
v0.10.0
v0.10.1
v0.10.2
v0.9.1
v0.9.2
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.3
v1.2.0
v1.2.1
v1.3.0
v1.3.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59037.json"