CVE-2024-12909
SQL Injection to RCE in run-llama/llama_index
- State
- Published
- Severity
- 10.0 Critical
- Published
- Mar 20, 2025
- Updated
- Mar 20, 2025
- Reserved
- Dec 23, 2024
Description
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL's large object functionality. The issue is fixed in version 0.3.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 10.0 Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | @huntr_ai |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected Products
| Product | Versions |
|---|---|
run-llama/llama_indexrun-llama |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.