diff --git a/docs/codeql/reusables/supported-frameworks.rst b/docs/codeql/reusables/supported-frameworks.rst
index 0552a3495175..45716fd408f7 100644
--- a/docs/codeql/reusables/supported-frameworks.rst
+++ b/docs/codeql/reusables/supported-frameworks.rst
@@ -256,6 +256,7 @@ and the CodeQL library pack ``codeql/python-all`` (`changelog <https://github.co
    cassandra-driver, Database
    clickhouse-driver, Database
    cx_Oracle, Database
+duckdb, Database
    hdbcli, Database
    mysql-connector, Database
    mysql-connector-python, Database
diff --git a/python/ql/lib/semmle/python/Frameworks.qll b/python/ql/lib/semmle/python/Frameworks.qll
index 1c2f0a6e6d41..9ddbea816ecc 100644
--- a/python/ql/lib/semmle/python/Frameworks.qll
+++ b/python/ql/lib/semmle/python/Frameworks.qll
@@ -28,6 +28,7 @@ private import semmle.python.frameworks.Cx_Oracle
 private import semmle.python.frameworks.data.ModelsAsData
 private import semmle.python.frameworks.Dill
 private import semmle.python.frameworks.Django
+private import semmle.python.frameworks.Duckdb
 private import semmle.python.frameworks.Fabric
 private import semmle.python.frameworks.FastApi
 private import semmle.python.frameworks.Flask
diff --git a/python/ql/lib/semmle/python/frameworks/Duckdb.qll b/python/ql/lib/semmle/python/frameworks/Duckdb.qll
new file mode 100644
index 000000000000..b35d95f5175e
--- /dev/null
+++ b/python/ql/lib/semmle/python/frameworks/Duckdb.qll
@@ -0,0 +1,44 @@
+/**
+ * Provides classes modeling security-relevant aspects of the `duckdb` PyPI package.
+ * See
+ * - https://duckdb.org/docs/stable/clients/python/overview
+ * - https://pypi.org/project/duckdb/
+ */
+
+private import python
+private import semmle.python.dataflow.new.DataFlow
+private import semmle.python.dataflow.new.RemoteFlowSources
+private import semmle.python.Concepts
+private import semmle.python.ApiGraphs
+private import semmle.python.frameworks.PEP249
+
+/**
+ * Provides models for the `duckdb` PyPI package.
+ * See
+ * - https://duckdb.org/docs/stable/clients/python/overview
+ * - https://pypi.org/project/duckdb/
+ */
+private module Duckdb {
+  /**
+   * A model of `duckdb` as a module that implements PEP 249, providing ways to execute SQL statements
+   * against a database.
+   */
+  class DuckdbPEP249 extends PEP249::PEP249ModuleApiNode {
+    DuckdbPEP249() { this = API::moduleImport("duckdb") }
+  }
+
+  /**
+   * A call to one of the module level functions `duckdb.sql`, `duckdb.execute` or
+   * `duckdb.executemany`, all of which immediately execute a SQL statement on the
+   * default connection.
+   *
+   * See https://duckdb.org/docs/stable/clients/python/overview
+   */
+  class ModuleLevelExecuteCall extends SqlExecution::Range, API::CallNode {
+    ModuleLevelExecuteCall() {
+      this = API::moduleImport("duckdb").getMember(["sql", "execute", "executemany"]).getACall()
+    }
+
+    override DataFlow::Node getSql() { result in [this.getArg(0), this.getArgByName("query")] }
+  }
+}
diff --git a/python/ql/src/change-notes/2026-08-15-duckdb-models.md b/python/ql/src/change-notes/2026-08-15-duckdb-models.md
new file mode 100644
index 000000000000..312c458fa744
--- /dev/null
+++ b/python/ql/src/change-notes/2026-08-15-duckdb-models.md
@@ -0,0 +1,8 @@
+## Change notes
+
+Add SQL injection models for the `duckdb` PyPI package. `duckdb` implements the
+Python DB-API 2.0 (PEP 249): `duckdb.connect()`, `connection.cursor()`,
+`cursor.execute()`, `cursor.executemany()` are now modeled as SQL execution
+sinks, and the module-level convenience wrappers `duckdb.sql()`,
+`duckdb.execute()` and `duckdb.executemany()` are additionally modeled as
+`SqlExecution` calls.