CVE-2024-12911: SQL Injection in run-llama/llama_index
First published: Thu Mar 20 2025(Updated: )
A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.12.3.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/llama-index | <0.12.3 | 0.12.3 |
| LlamaIndex | <0.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-12911?
CVE-2024-12911 is considered a high-severity vulnerability due to its potential for SQL injection leading to arbitrary file creation and Denial-of-Service attacks.
How do I fix CVE-2024-12911?
To fix CVE-2024-12911, update the `llama_index` package to version 0.12.3 or later.
What software is affected by CVE-2024-12911?
CVE-2024-12911 affects the `llama_index` package version below 0.12.3.
Can CVE-2024-12911 lead to data breaches?
Yes, CVE-2024-12911 can lead to data breaches due to its SQL injection capabilities.
Is CVE-2024-12911 still exploitable in the latest software versions?
No, CVE-2024-12911 is not exploitable in versions of `llama_index` that are 0.12.3 and above.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- collector/nvd-cve
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-jmgm-gx32-vp4w
- alias/CVE-2024-12911
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/source
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/guess-ai
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/github-advisory
- package-manager/pip
- vendor/run-llama
- canonical/llamaindex