CVE-2026-28438

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-28438

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28438.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-28438

Aliases

GHSA-59g6-v3vg-f7wc

Published

2026-03-06T06:39:08.934Z

Modified

2026-07-08T07:05:29.029718459Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements

Details

CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28438.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ]
}

References

Affected packages

Git / github.com/cocoindex-io/cocoindex

Affected ranges

Type

GIT

Repo

https://github.com/cocoindex-io/cocoindex

Events

Introduced

Fixed

ba2fc4a89e22d35572c64bd2990737c7913b0729

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:cocoindex:cocoindex:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.3.34"
        }
    ]
}

Affected versions

v0.*

v0.1.10

v0.1.12

v0.1.13

v0.1.14

v0.1.15

v0.1.16

v0.1.17

v0.1.18

v0.1.19

v0.1.2

v0.1.20

v0.1.21

v0.1.22

v0.1.23

v0.1.24

v0.1.25

v0.1.26

v0.1.27

v0.1.28

v0.1.29

v0.1.3

v0.1.30

v0.1.31

v0.1.32

v0.1.33

v0.1.34

v0.1.35

v0.1.36

v0.1.37

v0.1.38

v0.1.39

v0.1.4

v0.1.40

v0.1.41

v0.1.42

v0.1.43

v0.1.44

v0.1.45

v0.1.46

v0.1.47

v0.1.48

v0.1.49

v0.1.5

v0.1.50

v0.1.51

v0.1.52

v0.1.53

v0.1.54

v0.1.55

v0.1.56

v0.1.57

v0.1.58

v0.1.59

v0.1.6

v0.1.60

v0.1.61

v0.1.62

v0.1.63

v0.1.64

v0.1.65

v0.1.66

v0.1.67

v0.1.68

v0.1.69

v0.1.7

v0.1.70

v0.1.71

v0.1.72

v0.1.73

v0.1.74

v0.1.75

v0.1.76

v0.1.77

v0.1.78

v0.1.79

v0.1.8

v0.1.80

v0.1.81

v0.1.82

v0.1.83

v0.1.9

v0.2.0

v0.2.1

v0.2.10

v0.2.11

v0.2.12

v0.2.13

v0.2.14

v0.2.15

v0.2.16

v0.2.17

v0.2.18

v0.2.19

v0.2.2

v0.2.20

v0.2.21

v0.2.22

v0.2.23

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

v0.3.0

v0.3.1

v0.3.10

v0.3.11

v0.3.12

v0.3.13

v0.3.14

v0.3.15

v0.3.16

v0.3.17

v0.3.18

v0.3.19

v0.3.2

v0.3.20

v0.3.21

v0.3.22

v0.3.23

v0.3.24

v0.3.25

v0.3.26

v0.3.27

v0.3.28

v0.3.29

v0.3.3

v0.3.30

v0.3.31

v0.3.32

v0.3.33

v0.3.4

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.3.9

v1.*

v1.0.0-alpha.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28438.json"