CVE-2024-22682

PyPI/duckdb CVE-2024-22682: critical 9.8

DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature.

Action: Upgrade duckdb to 0.9.3.dev6 or later.

pip install duckdb==0.9.3.dev6

Affected

Fixed versions

Sources

• osv: PYSEC-2024-25
• https://github.com/Tu0Laj1/database_test

CVE-2024-22682 · published 2024-01-30T01:16:00Z · modified 2024-02-06T01:11:38.987577Z · JSON