Unverified50% confidenceFactExact time
In DuckDB, table functions such as read_csv, read_parquet and glob look like SELECT but can actually read local or remote files (such as /etc/passwd), forming a filesystem side channel; they must be blocked by function name, and literal table references such as FROM 'data.csv' must also be intercepted.
1
Sources
50%
Confidence
Long-term
Relevance
10/19/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedOn digital asset platforms, CSV is used for bulk metadata uploads (titles, keywords, descriptions, etc.); different platforms have strict rules on column order, names and counts, and mismatched headers cause uploads to be rejected.56% similarUnverifiedDify's document extractor node is responsible for reading information from uploaded files, and this step does not involve a large model.56% similarUnverifiedCloud functions should filter fields before returning data, and sensitive fields must not be returned directly and displayed on the frontend page.56% similarUnverifiedThe Reado app defends against similar attacks in the following ways: HTML files open as source code by default, Markdown and notebook output is sanitized via rehype-sanitize, the app's own CSP allows only script-src 'self' and covers Workers, file size does not change the loading method, and local image access is restricted to the opened project.56% similarUnverifiedPaperToProfit supports one-click CSV export for tax filing and bookkeeping, and provides a Dockerfile for easy containerized deployment.55% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1066690API
curl https://kongchang.com/api/v1/knowledge/claims/1066690MCP
get_claim(id=1066690)