PyPI/cocoindex CVE-2026-28438: critical 9.8, EPSS 0.53%
CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So,
Action: Upgrade cocoindex to 0.3.34 or later.
pip install cocoindex==0.3.34Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.3.34 | - |
Fixed versions
| 0.3.34 |
Sources
- osv: PYSEC-2026-2133
- https://github.com/cocoindex-io/cocoindex/security/advisories/GHSA-59g6-v3vg-f7wc
- https://github.com/cocoindex-io/cocoindex/commit/ba2fc4a89e22d35572c64bd2990737c7913b0729
CVE-2026-28438 · published · modified · JSON