CVE-2024-12911 HIGH

CVE-2024-12911: SQL Injection in run-llama/llama_index

Vendor Run-Llama
Product run-llama/llama_index
Weakness CWE-89 · SQLi
Published March 20, 2025
Last update October 15, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.5.1.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
October 15, 2025 Record updated