DuckDBPYSEC-2024-25
DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature.
Critical9.8CVE-2024-22682 · Published Jan 30, 2024 · updated Feb 6, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| duckdb PyPI | < 0.9.3.dev6 | 0.9.3.dev6 |
Details and references
DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the CVSS score
- Also known as
- CVE-2024-22682
More DuckDB advisories
All DuckDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 212025 | sniff_csv provides filesystem access even when enable_external_access is disabled in duckdb CVE-2024-41672High7.5fixed in 1.1.0 | High7.5 | 1.1.0 |
| Nov 122025 | DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator (pcg32) to generate cryptographic keys or I CVE-2025-64429Medium6.5fixed in 1.4.2 | Medium6.5 | 1.4.2 |