Duckdb vulnerabilities
We track 2 vulnerabilities in Duckdb products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 9, 2025.
2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score
Latest Duckdb vulnerabilities
- 8.6 High severity
duckdb-node: Embedded Malicious Code
DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware (along with several other packages). An attacker published new versions of four of DuckDB's package
- 7.5 High severity
duckdb: Exposure of Sensitive Information to an Unauthorized Actor
DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using `sniff_csv`, even with `enable_external_access=false`. This vulnerability provides an attacker with access to filesystem even when ac