TDengine versions prior to 3.4.1.15 contain a code injection vulnerability (CWE-94) where a user with create udf privilege can upload a malicious shared library as a user-defined function (e.g., eval) and execute arbitrary C code on the server side through database queries. This allows for remote code execution with the privileges of the database process. The vulnerability is addressed by an update in version 3.4.1.15.

Successful exploitation enables an attacker with create udf privilege to execute arbitrary C code on the TDengine server, potentially leading to full compromise of the database server, including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade TDengine to version 3.4.1.15 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Users should restrict the create udf privilege to trusted users only until the update is applied.