We use cookies to improve your experience on our site.
AVID-2026-R0028
Description
SQL Injection in run-llama/llama_index (CVE-2024-12911)
Details
A vulnerability in the default_jsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.5.1.
References
- NVD entry
- https://huntr.com/bounties/095f9e67-311d-494c-99c5-5e61a0adb8f3
- https://github.com/run-llama/llama_index/commit/bf282074e20e7dafd5e2066137dcd4cd17c3fb9e
Affected or Relevant Artifacts
- Developer: run-llama
- Deployer: run-llama
- Artifact Details:
| Type | Name |
|---|---|
| System | run-llama/llama_index |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.0 |
| Vector String | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H |
| Base Score | 7.1 |
| Base Severity | 🔴 High |
| Attack Vector | NETWORK |
| Attack Complexity | 🟢 Low |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | 🟢 Low |
| Availability Impact | 🔴 High |
CWE
| ID | Description |
|---|---|
| CWE-89 | CWE-89 Improper Neutralization of Special Elements used in an SQL Command |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2025-03-20
- Version: 0.3.1
- AVID Entry