Skip to content
OpenAdvisories

Vendor

duckdb

4 known vulnerabilities.

Products

duckdb 2 duckdb-node 1 duckdb-aws 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.6
    CVE-2025-59037

    DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware

    DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's packag…

    duckdb duckdb-node @duckdb/node-api @duckdb/duckdb-wasm npm
  • High 7.5
    CVE-2024-41672

    DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled

    DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when a…

    duckdb duckdb duckdb PyPI