CVE-2026-28438 Details
Description
CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So, in the application code, if the table name is provided by an untrusted upstream, it expose vulnerability to SQL injection when target schema change. This issue has been patched in version 0.3.34.
A SQL injection vulnerability has been identified in the CocoIndex data transformation framework for AI, specifically within the Doris target connector versions prior to 0.3.34. The issue arises because the connector did not validate the table name before generating certain SQL statements, such as 'ALTER TABLE'. As a result, if an untrusted source provided the table name, it could lead to SQL injection vulnerabilities during schema changes. This flaw has been addressed in version 0.3.34.
Users are advised to update to CocoIndex version 0.3.34 or later, where this vulnerability has been patched. Additionally, ensure that table names used with the Doris target are valid and sourced from trusted origins. If table names must be obtained from untrusted sources, they should be validated before use.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cocoindex cocoindex | < 0.3.34 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |