A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. This can lead to remote code execution (RCE) by installing the shellfs extension and executing malicious commands.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/run-llama/llama_index/commit/35bd221e948e40458052d30c6ef2779bc965b6d0 | Patch |
| https://huntr.com/bounties/8ddf66e1-f74c-4d53-992b-76bc45cacac1 | Exploit Third Party Advisory |
Configurations
History
29 Jul 2025, 18:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Llamaindex llamaindex
Llamaindex |
|
| References | () https://huntr.com/bounties/8ddf66e1-f74c-4d53-992b-76bc45cacac1 - Exploit, Third Party Advisory | |
| References | () https://github.com/run-llama/llama_index/commit/35bd221e948e40458052d30c6ef2779bc965b6d0 - Patch | |
| CPE | cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:* |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-29 18:57
NVD link : CVE-2024-11958
Mitre link : CVE-2024-11958
JSON object : View
Products Affected
llamaindex
- llamaindex
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')