CVE-2024-11958 CRITICAL

CVE-2024-11958: SQL Injection in run-llama/llama_index

Vendor Run-Llama
Product run-llama/llama_index
Weakness CWE-89 · SQLi
Published March 20, 2025
Last update March 20, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. This can lead to remote code execution (RCE) by installing the shellfs extension and executing malicious commands.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated