{"action":"Upgrade cocoindex to 0.3.34 or later.","affected":[{"fixed":"0.3.34","introduced":"0"}],"component":"cocoindex","cve_ids":["CVE-2026-28438"],"ecosystem":"PyPI","epss":0.00527,"exploited":false,"fixed_versions":["0.3.34"],"ghsa_id":"GHSA-59g6-v3vg-f7wc","id":"tcs_01M5KGXNGRG5QE3PVMDCNJC32E","modified_at":"2026-07-13T07:15:21.896320607Z","published_at":"2026-03-06T07:15:58.770Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2133","https://github.com/cocoindex-io/cocoindex/security/advisories/GHSA-59g6-v3vg-f7wc","https://github.com/cocoindex-io/cocoindex/commit/ba2fc4a89e22d35572c64bd2990737c7913b0729"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-2133","url":"https://osv.dev/vulnerability/PYSEC-2026-2133"}],"summary":"CocoIndex is a data transformation framework for AI. Prior to version 0.3.34, the Doris target connector didn't verify the configured table name before creating some SQL statements (ALTER TABLE). So,"}