A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL's large object functionality. The issue is fixed in version 0.3.0.
References
| Link | Resource |
|---|---|
| https://github.com/run-llama/llama_index/commit/5d03c175476452db9b8abcdb7d5767dd7b310a75 | Patch |
| https://huntr.com/bounties/44e8177f-200a-4ba3-a12c-8bc21e313a3f | Exploit Third Party Advisory |
Configurations
History
30 Jul 2025, 01:00
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:* | |
| First Time |
Llamaindex llamaindex
Llamaindex |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | () https://huntr.com/bounties/44e8177f-200a-4ba3-a12c-8bc21e313a3f - Exploit, Third Party Advisory | |
| References | () https://github.com/run-llama/llama_index/commit/5d03c175476452db9b8abcdb7d5767dd7b310a75 - Patch |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-30 01:00
NVD link : CVE-2024-12909
Mitre link : CVE-2024-12909
JSON object : View
Products Affected
llamaindex
- llamaindex
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')