{"action":"Upgrade duckdb to 0.9.3.dev6 or later.","affected":[{"fixed":"0.9.3.dev6","introduced":"0"}],"component":"duckdb","cve_ids":["CVE-2024-22682"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.9.3.dev6"],"id":"tcs_01M5KGMQMGJSB9SVQ7RS7YY7YM","modified_at":"2024-02-06T01:11:38.987577Z","published_at":"2024-01-30T01:16:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-25","https://github.com/Tu0Laj1/database_test"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2024-25","url":"https://osv.dev/vulnerability/PYSEC-2024-25"}],"summary":"DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature."}