CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-59g6-v3vg-f7wc | CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 06 Mar 2026 07:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34. | |
| Title | CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements | |
| Weaknesses | CWE-89 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-03-06T06:39:08.934Z
Reserved: 2026-02-27T15:54:05.139Z
Link: CVE-2026-28438
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-06T07:15:58.770
Modified: 2026-03-06T07:15:58.770
Link: CVE-2026-28438
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses