LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Drop the Students table" within English language input.
References
| Link | Resource |
|---|---|
| https://github.com/run-llama/llama_index/issues/9957 | Exploit Issue Tracking Vendor Advisory |
| https://github.com/run-llama/llama_index/issues/9957 | Exploit Issue Tracking Vendor Advisory |
Configurations
History
21 Nov 2024, 08:58
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/run-llama/llama_index/issues/9957 - Exploit, Issue Tracking, Vendor Advisory |
29 Jan 2024, 15:06
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:* | |
| First Time |
Llamaindex llamaindex
Llamaindex |
|
| References | () https://github.com/run-llama/llama_index/issues/9957 - Exploit, Issue Tracking, Vendor Advisory |
22 Jan 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-22 01:15
Updated : 2024-11-21 08:58
NVD link : CVE-2024-23751
Mitre link : CVE-2024-23751
CVE.ORG link : CVE-2024-23751
JSON object : View
Products Affected
llamaindex
- llamaindex
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')