GHSA-59g6-v3vg-f7wc

Suggest an improvement
Source
https://github.com/advisories/GHSA-59g6-v3vg-f7wc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-59g6-v3vg-f7wc/GHSA-59g6-v3vg-f7wc.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-59g6-v3vg-f7wc
Aliases
Published
2026-03-02T20:27:48Z
Modified
2026-07-13T07:26:15Z
Severity
  • 8.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements
Details

Impact

The Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change.

Patches

Yes, it's fixed in cocoindex 0.3.34: we start to validate table names passed to Doris target at entry point and error out immediately if it's not a valid identifier.

Workarounds

Users should make sure table names used to configure CocoIndex targets are valid, regardless of this fix. Which means

  • The table name comes from a trusted source (e.g. for most cases it's just a fixed string literal).
  • Even if it comes from an untrusted source (e.g. provided by end user), it should be validated before using it to configure the Doris target for CocoIndex.
Database specific 
{
    "cwe_ids":  [
        "CWE-89"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-02T20:27:48Z",
    "nvd_published_at":  "2026-03-06T07:15:58Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / cocoindex

Package

Name
cocoindex
View open source insights on deps.dev
Purl
pkg:pypi/cocoindex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.3.34

Affected versions

0.*
0.1.43
0.1.44
0.1.45
0.1.46
0.1.47
0.1.48
0.1.49
0.1.50
0.1.51
0.1.52
0.1.53
0.1.54
0.1.55
0.1.56
0.1.57
0.1.58
0.1.59
0.1.60
0.1.61
0.1.62
0.1.63
0.1.64
0.1.65
0.1.66
0.1.67
0.1.68
0.1.69
0.1.70
0.1.71
0.1.72
0.1.73
0.1.74
0.1.75
0.1.76
0.1.77
0.1.78
0.1.79
0.1.80
0.1.81
0.1.82
0.1.83
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.15
0.2.16
0.2.17
0.2.18
0.2.19
0.2.20
0.2.21
0.2.22
0.2.23
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.20
0.3.21
0.3.22
0.3.23
0.3.24
0.3.25
0.3.26
0.3.27
0.3.28
0.3.29
0.3.30
0.3.31
0.3.32
0.3.33

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-59g6-v3vg-f7wc/GHSA-59g6-v3vg-f7wc.json"