PYSEC-2026-2437 Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

Summary The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...

PYSEC-2026-2436 Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

Summary The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...

dbt-duckdb-kedro-datasets (>=0.1.0, <=0.1.2), kedro-graphql (>=0.5.0, <=0.5.1) +1 more potentially affected by CVE-2026-35492 via kedro-datasets (3.0.1)

kedro-datasets PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kedro-datasets and may be impacted: - dbt-duckdb-kedro-datasets =0.1.0, =0.5.0, =0.2.0, =0.3.0rc1 Source cves: CVE-2026-35492 Source advisory: OSV:PYSEC-2026-2545...

PT-2026-59669

Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and...

PT-2026-59107

Summary The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...

PT-2026-59106

Summary The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...

PT-2026-59104

Summary The DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers constructed SQL WHERE clauses by interpolating dynamic partition key values into queries without escaping. A user with the Add Dynamic Partitions permission could create a partition key that injects arbitrary SQL, which would...

duckdb:csv_json_fuzz_test: Stack-buffer-overflow in duckdb::StrpTimeFormat::Parse

Project: https://github.com/duckdb/duckdb.git Detailed Report: https://oss-fuzz.com/testcase?key=5326739891617792 Project: duckdb Fuzzing Engine: libFuzzer Fuzz Target: csvjsonfuzztest Job Type: libfuzzerasanduckdb Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address:...

External Control of File Name or Path

Overview recce is an Environment diff tool for dbt Affected versions of this package are vulnerable to External Control of File Name or Path via the query run API when configured with a DuckDB-backed project. An attacker can access or modify local files accessible to the server process, potential...

GHSA-RH62-J648-G5QC Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and...

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and...

PT-2026-55458

Name of the Vulnerable Software and Affected Versions Recce versions prior to 1.50.0 Description Recce OSS server deployments exposed to untrusted networks without authentication allow unauthenticated SQL execution via the query run API endpoint. When configured with a DuckDB-backed project, an...

PT-2026-55416

Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and...

LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection

A SQL injection vulnerability exists in the duckdbretriever component of the run-llama/llamaindex repository, specifically in llama-index-retrievers-duckdb-retriever prior to v0.4.0. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an...

Exploit for Code Injection in Grafana

CVE-2024-9264 CVE-2024-9264 취약점 실습 보고서 1. 취약점 요약 | 항목...

PT-2026-53483

A SQL injection vulnerability exists in the duckdb retriever component of the run-llama/llama index repository, specifically in llama-index-retrievers-duckdb-retriever prior to v0.4.0. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an...

PT-2026-53417

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the...

GO-2026-5523 Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks in github.com/basekick-labs/arc

Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks in github.com/basekick-labs/arc...

Malicious code in @mastra/duckdb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4754e9321d534c89f59052bd2ca5ce38c6d3916eba9a5e0990e0186c7beac14 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5944 Malicious code in @mastra/duckdb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4754e9321d534c89f59052bd2ca5ce38c6d3916eba9a5e0990e0186c7beac14 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...