Duckdb

4 CVEs across 3 Duckdb products. Browse Duckdb vulnerabilities, severities, and proof-of-concept exploits.

Duckdb products with known CVEs

ProductCVEs
Duckdb2
Duckdb-Aws1
Duckdb-Node1
Duckdb CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-58139Medium6.52026-08-03The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract pla…
CVE-2025-64429Medium6.52025-11-12DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issue…
CVE-2025-590372025-09-09DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malwar…
CVE-2024-41672High7.52024-07-24DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_e…