CVE-2026-28438

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-28438
CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/cocoindex-io/cocoindex/commit/ba2fc4a89e22d35572c64bd2990737c7913b0729 Patch
https://github.com/cocoindex-io/cocoindex/security/advisories/GHSA-59g6-v3vg-f7wc Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cocoindex:cocoindex:*:*:*:*:*:*:*:*
History

10 Mar 2026, 19:47

Type Values Removed Values Added
References () https://github.com/cocoindex-io/cocoindex/commit/ba2fc4a89e22d35572c64bd2990737c7913b0729 - () https://github.com/cocoindex-io/cocoindex/commit/ba2fc4a89e22d35572c64bd2990737c7913b0729 - Patch
References () https://github.com/cocoindex-io/cocoindex/security/advisories/GHSA-59g6-v3vg-f7wc - () https://github.com/cocoindex-io/cocoindex/security/advisories/GHSA-59g6-v3vg-f7wc - Mitigation, Vendor Advisory
Summary
  • (es) CocoIndex es un framework de transformación de datos para IA. Antes de la versión 0.3.34, el conector de destino de Doris no verificaba el nombre de tabla configurado antes de crear algunas sentencias SQL (ALTER TABLE). Así, en el código de la aplicación, si el nombre de la tabla es proporcionado por una fuente no confiable, expone una vulnerabilidad a la inyección SQL cuando el esquema de destino cambia. Este problema ha sido parcheado en la versión 0.3.34.
CPE cpe:2.3:a:cocoindex:cocoindex:*:*:*:*:*:*:*:*
First Time Cocoindex
Cocoindex cocoindex
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8

06 Mar 2026, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-06 07:15

Updated : 2026-03-10 19:47

NVD link : CVE-2026-28438

Mitre link : CVE-2026-28438

CVE.ORG link : CVE-2026-28438

JSON object : View

Products Affected

cocoindex

  • cocoindex
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')