PyPI/recce CVE-2026-49360: high 7.8, EPSS 1.07%

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Action: Upgrade recce to 1.50.0 or later.

pip install recce==1.50.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-3049
• nvd: CVE-2026-49360
• https://github.com/DataRecce/recce/security/advisories/GHSA-rh62-j648-g5qc
• https://github.com/DataRecce/recce
• https://github.com/DataRecce/recce/releases/tag/v1.50.0
• https://pypi.org/project/recce
• https://github.com/advisories/GHSA-rh62-j648-g5qc

CVE-2026-49360 · published 2026-07-13T15:46:27.898921Z · modified 2026-07-13T16:32:43.979774426Z · JSON