Fail input validation in clickhouse-library-bridge API could lead to RCE under specific configuration

Description

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits file uploads to specific directories, a misconfigured server can be exploited by an attacker with privilege to access to both table engines to execute arbitrary code on the ClickHouse server. You can check if your ClickHouse server is vulnerable to this vulnerability by inspecting the configuration file and confirming if the following setting is enabled: <library_bridge> <port>9019</port> </library_bridge>

Scores

EPSS (exploitation in 30 days)

0.46% · top 60% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-20 Improper Input Validation (opens in a new tab)All about CWE-20 and its CVEs

Affected products

• ClickHouse · ClickHouse OSS

  • affected 24.3 – < 24.3.18.6
  • affected 24.8 – < 24.8.14.27
  • affected 24.11 – < 24.11.5.34
  • affected 24.12 – < 24.12.5.65
  • affected 25.1 – < 25.1.5.5

References (1)

• https://github.com/ClickHouse/ClickHouse/security/advisories/GHSA-5phv-x8x4-83x5 (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-1385](https://trackcve.app/badge/CVE-2025-1385.svg)](https://trackcve.app/cve/CVE-2025-1385)

Record last updated 20 Mar 2025, 15:10 UTC.