SQL Injection Vulnerability in run-llama's JSONalyzeQueryEngine
CVE-2024-12911

7.1HIGH

Key Information:

Vendor

Run-llama

Status
Run-llama/llama Index
Vendor
CVE Published:
20 March 2025

What is CVE-2024-12911?

A vulnerability in the default_jsonalyzer function of the JSONalyzeQueryEngine within the run-llama/llama_index repository enables attackers to exploit SQL injection through prompt injection methods. This exposure could potentially allow for arbitrary file creation and lead to Denial-of-Service (DoS) attacks. Users are advised to update to version 0.5.1, which addresses this issue effectively.

Affected Version(s)

run-llama/llama_index < 0.5.1

References

https://huntr.com/bounties/095f9e67-311d-494c-99c5-5e61a0...
https://github.com/run-llama/llama_index/commit/bf282074e...

CVSS V3.0

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.