Executive brief
Recce, a tool used for data validation and impact analysis, contains a vulnerability in its server component that allows unauthorized users to execute database commands. If the server is exposed to a network without authentication and uses a DuckDB database, an attacker can read or write sensitive files on the server's host system. This could lead to the theft of private data, tampering with application files, or the insertion of malicious scripts into the user interface.
Technical details
The Recce OSS server's query run API fails to enforce authentication, allowing remote attackers to submit arbitrary SQL queries. When the application is configured with a DuckDB-backed project, attackers can utilize DuckDB's built-in filesystem primitives to perform unauthorized file reads and writes on the host system. This vulnerability, classified as External Control of File Name or Path (CWE-73), can lead to local file inclusion, tampering with dbt artifacts, or stored XSS by modifying static web assets. The impact is escalated if the Recce process is running with root privileges. The issue is resolved in version 1.50.0 by restricting unsafe file operations in the DuckDB adapter.
Affected products
- DataRecce recce <= 1.49.0
Timeline
- 2026-05-27: patched: Version 1.50.0 released
- 2026-06-01: disclosed: Initial advisory publication
- 2026-07-02: advisory: GitHub Advisory published