PyPI/recce CVE-2026-49360: high, EPSS 1.07%

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Action: Upgrade recce to 1.50.0 or later.

pip install recce==1.50.0

Affected

Fixed versions

Sources

• osv: GHSA-rh62-j648-g5qc
• https://github.com/DataRecce/recce/security/advisories/GHSA-rh62-j648-g5qc
• https://github.com/DataRecce/recce
• https://github.com/DataRecce/recce/releases/tag/v1.50.0

CVE-2026-49360 · published 2026-07-02T21:14:38Z · modified 2026-07-13T16:43:49.225343990Z · JSON