{"id":"CVE-2026-28438","aliases":["GHSA-59g6-v3vg-f7wc","PYSEC-2026-2133"],"url":"https://o3.security/vulnerability/CVE-2026-28438","summary":"CocoIndex Doris target connector didn't verify table name when constructing ALTER TABLE statements","details":"### Impact\nThe Doris target connector didn't verify the configured table name before creating some SQL statements (`ALTER TABLE`). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change.\n\n### Patches\nYes, it's fixed in cocoindex 0.3.34: we start to validate table names passed to Doris target at entry point and error out immediately if it's not a valid identifier.\n\n### Workarounds\nUsers should make sure table names used to configure CocoIndex targets are valid, regardless of this fix. Which means\n\n- The table name comes from a trusted source (e.g. for most cases it's just a fixed string literal).\n- Even if it comes from an untrusted source (e.g. provided by end user), it should be validated before using it to configure the Doris target for CocoIndex.","published":"2026-03-06T06:39:08.934Z","modified":"2026-08-12T03:51:22.339933242Z","cvss":null,"epss":{"score":0.00282,"percentile":0.20083,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"cocoindex","fixedVersion":"0.3.34"}],"fix":{"url":"https://github.com/cocoindex-io/cocoindex/commit/ba2fc4a89e22d35572c64bd2990737c7913b0729","label":"cocoindex-io/cocoindex@ba2fc4a"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28438.json"},{"type":"ADVISORY","url":"https://github.com/cocoindex-io/cocoindex/security/advisories/GHSA-59g6-v3vg-f7wc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28438"},{"type":"FIX","url":"https://github.com/cocoindex-io/cocoindex/commit/ba2fc4a89e22d35572c64bd2990737c7913b0729"},{"type":"PACKAGE","url":"https://github.com/cocoindex-io/cocoindex"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:22.339933242Z"}}