PT-2024-20057 · Unknown · Llama Index
Fubuki8087
·
Published
2024-01-21
·
Updated
2026-02-19
·
CVE-2024-23751
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
LlamaIndex (aka llama index) versions 0.9.34 and earlier
Description
The issue allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Drop the Students table" within English language input.
Recommendations
For versions 0.9.34 and earlier, consider disabling the Text-to-SQL feature in the affected engines until a patch is available. Restrict access to the NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine to minimize the risk of exploitation. Avoid using the Text-to-SQL feature with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Llama Index