Advisoriesby IbisLlamaIndexGHSA-2jxw-4hm4-6w87
SQL injection in llama-index
No fix yet
LlamaIndex (aka llama_index) through 0.9.35 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Drop the Students table" within English language input.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| llama-index PyPI | <= 0.9.35 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-89
- Also known as
- CVE-2024-23751, PYSEC-2024-12
More LlamaIndex advisories
All LlamaIndex
LlamaIndex Improper Handling of Exceptional Conditions vulnerabilityCVE-2024-12704fixed in 0.12.6LlamaIndex includes an exec call for `import {cls_name}`CVE-2024-45201fixed in 0.10.38RunGptLLM class in LlamaIndex has a command injectionCVE-2024-4181fixed in 0.10.13llama-index-core Command Injection vulnerabilityCVE-2024-3271fixed in 0.10.24llama-index-core Prompt Injection vulnerability leading to Arbitrary Code ExecutionCVE-2024-3098fixed in 0.10.24llama-index vulnerable to arbitrary code executionCVE-2023-39662fixed in 0.9.14