CVE-2024-12909
Critical
Description
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL's large object functionality. The issue is fixed in version 0.3.0.
SeverityCritical
CVSS9.8
Exploit probability—
ProductLlamaindex
PublishedMar 20, 2025
First seenMar 20, 2025
Weakness typeCWE-89SQL injection
How to fix
Update
- llamaindex llamaindex0.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| llamaindex llamaindex | v < 0.3.0 | 0.3.0 |
| llama-index-packs-finchatPyPI | v ≤ 0.3.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.