Recce CVE-2026-49360
HIGH
GHSA-rh62-j648-g5qc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint (AV:N/PR:N/AC:L), scope changes because stored XSS impacts browser users (S:C), confidentiality limited to process-accessible files (C:L), high integrity impact from arbitrary file writes and persistent XSS injection (I:H), no availability impact identified (A:N).
Primary rating from Vendor (https://github.com/DataRecce/recce).
CVSS VectorVendor: https://github.com/DataRecce/recce
Lifecycle Timeline
5DescriptionCVE.org
Impact
Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API.
When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and write files accessible to the Recce server process. The impact depends on how Recce is deployed, but may include disclosure of local files, tampering with Recce/dbt artifacts, modification of browser-served static files leading to stored XSS, and modification of application files if those paths are writable. If Recce is run as root, file access occurs with root privileges inside that host or container.
Patches
This issue has been patched in Recce v1.50.0. Users should upgrade to Recce v1.50.0 or later.
The patch restricts unsafe file read/write behavior for DuckDB-backed query execution and hardens the affected query path. Other warehouse adapters have also been reviewed for similar exposure.
Credits
Thanks to Sitampan (@hxcbtc) for responsibly reporting this issue.
Workarounds
Users who cannot upgrade immediately should avoid exposing recce server to the public internet or any untrusted network.
Recommended mitigations include enabling authentication or placing Recce behind an authenticated reverse proxy/VPN, running Recce as a non-root user, using a read-only application filesystem where possible, and ensuring that sensitive files or credentials are not available to the Recce process.
AnalysisAI
Unauthenticated SQL execution through Recce's query run API exposes DuckDB-backed deployments to arbitrary local file read and write by any network-reachable attacker. All pip/recce versions up to and including 1.49.0 are affected when the server is exposed to an untrusted network without authentication. Attackers can exfiltrate files accessible to the Recce process, tamper with dbt artifacts, inject stored XSS into browser-served static files, and achieve root-level file access if Recce runs as root. No public exploit has been identified at time of analysis; vendor-released patch is available in v1.50.0.
Technical ContextAI
Recce (pkg:pip/recce) is a Python-based open-source dbt companion server used to compare data models across environments. It supports multiple warehouse adapters; the vulnerability specifically affects the DuckDB adapter. DuckDB exposes powerful built-in filesystem primitives - functions such as read_text(), write_text(), and glob-capable parquet_scan() - that can be invoked directly through standard SQL. CWE-73 (External Control of File Name or Path) identifies the root cause: the query run API endpoint passes attacker-supplied SQL to DuckDB without restricting its filesystem-level functions, enabling full path traversal and arbitrary file I/O bounded only by the process's OS-level permissions. Because the endpoint also lacks authentication enforcement, the attack surface is fully available to unauthenticated callers on any network to which the server is exposed.
RemediationAI
The primary fix is to upgrade to Recce v1.50.0 or later via pip install --upgrade recce; the release is available at https://github.com/DataRecce/recce/releases/tag/v1.50.0 and the advisory is at https://github.com/DataRecce/recce/security/advisories/GHSA-rh62-j648-g5qc. The patch restricts DuckDB's filesystem primitives within the query execution path. For deployments that cannot upgrade immediately, the vendor recommends the following compensating controls: (1) Avoid exposing recce server to the public internet or any untrusted network - binding to localhost and tunneling access is the strongest isolation with no trade-offs beyond access convenience. (2) Place Recce behind an authenticating reverse proxy (e.g., nginx with HTTP Basic Auth or OAuth2 Proxy) or a VPN - this eliminates the unauthenticated exposure but adds infrastructure complexity and a dependency on the proxy's own security. (3) Run Recce as a non-root, minimally privileged OS user - this limits file access to the user's home directory and application paths rather than the entire filesystem, though it does not eliminate file read/write risk. (4) Mount or make available only the directories strictly required by the Recce process, and use a read-only filesystem for application and static content paths where possible - this prevents the stored XSS write vector but requires container or filesystem configuration changes. Removing sensitive credentials and files from any path accessible to the Recce process is advised regardless of whether upgrade is performed immediately.
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today