CVE-2024-12909

CRITICAL

9.8

Beschreibung

A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL's large object functionality. The issue is fixed in version 0.3.0.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/20/2025

Zuletzt geandert7/30/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

llamaindex:llamaindex

Schwachen (CWE)

CWE-89

Referenzen

https://github.com/run-llama/llama_index/commit/5d03c175476452db9b8abcdb7d5767dd7b310a75(security@huntr.dev)

https://huntr.com/bounties/44e8177f-200a-4ba3-a12c-8bc21e313a3f(security@huntr.dev)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.