CRITICAL9.8
PYSEC-2024-25
Quick fix
PYSEC-2024-25 — duckdb: upgrade to the fixed version with the command below.
pip install --upgrade 'duckdb>=0.9.3.dev6'Details
DuckDB <=0.9.2 and DuckDB extension-template <=0.9.2 are vulnerable to malicious extension injection via the custom extension feature.
Are you affected?
Enter the version of the package you're using.