CocoIndex's Doris target connector constructs "ALTER TABLE" statements without validating the table name supplied by upstream sources. The SQL injection flaw can give an attacker the ability to alter database tables, create or drop columns, and potentially modify data or schemata, compromising both data integrity and confidentiality. The weakness is a classic input validation flaw (CWE‑89).

The vulnerability affects CocoIndex deployments running any version earlier than 0.3.34, regardless of installation environment. All products listed under the CocoIndex brand using the Doris connector are impacted.

Based on the description, it is inferred that exploiting this flaw would require an attacker to supply a malicious table name through an untrusted upstream source that feeds into the Doris connector. The vulnerability then allows the attacker to manipulate ALTER TABLE statements, potentially adding, dropping, or modifying columns and thereby altering the database schema. The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% signals a low likelihood of exploitation in the wild; the vulnerability is not listed in CISA’s KEV catalog. If this ability is achieved, the attacker could compromise data integrity and confidentiality by changing or destroying schema definitions.