CVE-2026-28438 is an SQL injection in the CocoIndex Doris target connector, a data transformation framework for AI. The connector did not validate the configured table name before building ALTER TABLE statements. NVD scores it 9.8. Upgrade cocoindex to 0.3.34 or later and validate table names.
What's affected
The GitHub advisory GHSA-59g6-v3vg-f7wc lists affected version 0.3.28 and patched version 0.3.34. The NVD description says versions prior to 0.3.34, which is the safer reading for planning.
The condition is narrow and important. The advisory says that in application code, if the table name is provided by an untrusted upstream, the Doris connector exposes SQL injection when the target schema changes. If your table names are fixed strings in your code, the described exposure does not arise.
The maintainers rate it Moderate, while NVD scores 9.8. The gap reflects that the dangerous input is a configuration value your own code supplies, not a field a stranger can reach directly. Whether that value is attacker influenced depends entirely on your application. The weakness is CWE-89 (SQL Injection).
How to check if you're exposed
Find the installed version in each environment.
pip show cocoindex
Check lockfiles and container images as well. Then review how your application sets the Doris target's table name. If it is a literal in code, you are in the safe pattern the advisory describes. If it comes from a request, a tenant setting, a file or any other upstream you do not control, treat it as untrusted.
Paste your package manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan to see which projects pull in the affected package, including indirect dependencies.
What to do now
- Upgrade cocoindex to 0.3.34 or later and refresh your lockfile.
- Make sure table names used to configure CocoIndex targets come from a trusted source, ideally fixed strings.
- If a name must come from outside, validate it as a plain identifier before passing it to the connector. The advisory recommends this whatever the version.
- Review Doris permissions for the account CocoIndex uses and remove rights it does not need, so injected statements have less to do.
- Re-scan your dependencies after the upgrade to catch older copies in other services.
Why it matters
The fix tells you the shape of the bug. From 0.3.34, table names passed to the Doris target are validated at the entry point and the call fails at once if the name is not a valid identifier. Before that, the name was inserted into SQL text without checking.
Identifiers are a place where parameterised queries do not help, because databases generally do not accept a parameter in place of a table name. The safe approach is to check the name against a strict identifier pattern or an allow list. Many injection bugs live in exactly these spots: ORDER BY clauses, table names and column names.
The reason this matters for AI data pipelines is that they are often configured dynamically. A framework that builds targets from tenant settings or from metadata discovered in sources can turn data into configuration, and configuration into SQL.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog. A software composition scan finds the vulnerable package, and the inventory view below shows how to see all your dependencies at once.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does my pipeline have this problem if table names are constants?
The advisory describes exposure when the table name comes from an untrusted upstream. Constants avoid that, but upgrading is still sensible.
Why can't a parameterised query fix this?
Databases usually accept parameters for values, not for identifiers such as table names. Identifiers need validation instead.
Sources
Last reviewed: 19 October 2026.
