SQL Injection Vulnerability in DuckDB Retriever of Run-Llama Repository

CVE-2024-11958

What is CVE-2024-11958?

A vulnerability exists in the DuckDB Retriever component of the Run-Llama repository that allows for SQL injection due to improper handling of SQL queries. Attackers can exploit this weakness by injecting arbitrary SQL code, posing a risk of unauthorized access and remote code execution. This security flaw stems from the lack of prepared statements in query construction, making it imperative for users to apply the necessary updates and implement additional security measures to safeguard against potential exploits.

References