AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

LlamaIndexGHSA-jmgm-gx32-vp4w

LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions

LlamaIndex

CVE-2024-12911 · Published Mar 20, 2025 · updated Jul 7, 2026

High7.1
Fix: upgrade to 0.12.3 or later
GitHub advisory

A vulnerability in the default_jsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.12.3.

Affected versions

PackageAffectedFixed in
llama-index
PyPI
< 0.12.30.12.3
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-379, CWE-89
Also known as
CVE-2024-12911, PYSEC-2026-1555

More LlamaIndex advisories

All LlamaIndex
Critical 9.8Jun 5, 2025llama_index vulnerable to SQL InjectionCVE-2025-1793fixed in 0.12.28Critical 9.8Jun 2, 2025LlamaIndex: SQL injectionCVE-2025-1750fixed in 0.12.21High 7.8May 28, 2025LlamaIndex: command injectionCVE-2025-1753no fix yetHigh 7.5May 10, 2025LlamaIndex Vulnerable to Denial of Service (DoS)CVE-2025-1752fixed in 0.12.21Medium 5.9Mar 20, 2025LlamaIndex Uncontrolled Resource Consumption vulnerabilityCVE-2024-12910fixed in 0.12.9High 7.5Mar 20, 2025LlamaIndex Improper Handling of Exceptional Conditions vulnerabilityCVE-2024-12704fixed in 0.12.6