CVE-2026-28438

CVE-2026-28438 describes a SQL injection vulnerability in CocoIndex versions prior to 0.3.34, specifically within the Doris target connector. This flaw arises because the connector fails to validate untrusted table names before generating ALTER TABLE statements, potentially allowing an attacker to inject malicious SQL queries if the table name originates from an untrusted source. Rated with a CVSS score of 6.9 (Medium), this vulnerability has a network attack vector and low attack complexity, requiring no privileges or user interaction. A successful exploit could lead to limited integrity impact, allowing unauthorized modification of data within the database. Currently, there is no evidence of active exploitation, and no public exploit code (e.g., Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness or concern at this time.