Executive brief
DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature.
Affected products
- PyPI duckdb
Junglewise Threat Intelligence
CVE-2024-22682: PYSEC-2024-25 - DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature.
CVE-2024-22682 · Severity: low · CVSS 3.1 · Published 2024-01-30
Technologies: duckdb (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2025-112 - DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. Th
- PYSEC-2024-203 - DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`