SQL Injection Vulnerability in DuckDB Retriever of Run-Llama Repository
CVE-2024-11958

9.8CRITICAL

Key Information:

Vendor

Run-llama

Status
Run-llama/llama Index
Vendor
CVE Published:
20 March 2025

What is CVE-2024-11958?

A vulnerability exists in the DuckDB Retriever component of the Run-Llama repository that allows for SQL injection due to improper handling of SQL queries. Attackers can exploit this weakness by injecting arbitrary SQL code, posing a risk of unauthorized access and remote code execution. This security flaw stems from the lack of prepared statements in query construction, making it imperative for users to apply the necessary updates and implement additional security measures to safeguard against potential exploits.

Affected Version(s)

run-llama/llama_index < 0.4.0

References

https://huntr.com/bounties/8ddf66e1-f74c-4d53-992b-76bc45...
https://github.com/run-llama/llama_index/commit/35bd221e9...

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.