duckdb
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| duckdb | 2 | – | Nov 12, 2025 |
| duckdb-aws | 1 | – | Aug 3, 2026 |
| duckdb-node | 1 | – | Sep 9, 2025 |
Exploited and recent CVEs
- CVE-2026-58139 DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure 0.5%
- CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable 0.1%
- CVE-2025-59037 DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware 0.4%
- CVE-2024-41672 DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled 0.8%