PT-2025-12114 · Unknown · Llama Index

Published 2025-03-20 · Updated 2025-07-29 · CVE-2024-11958

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions run-llama/llama index versions prior to v0.4.0

Description A SQL injection vulnerability exists in the duckdb retriever component. The issue stems from constructing SQL queries without utilizing prepared statements, which allows for the injection of arbitrary SQL code. Successful exploitation can lead to remote code execution (RCE) through the installation of the shellfs extension and subsequent execution of malicious commands.

Recommendations Update to version 0.4.0 or later to resolve this issue.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-11958

GHSA-339R-CJV9-X78G

Affected Products

Llama Index

References · 8

• 🔥 https://huntr.com/bounties/8ddf66e1-f74c-4d53-992b-76bc45cacac1 · Exploit
• https://github.com/run-llama/llama_index/commit/35bd221e948e40458052d30c6ef2779bc965b6d0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-11958 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11958 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-339r-cjv9-x78g · Vendor Advisory
• https://github.com/run-llama/llama_index · Note
• https://twitter.com/CVEnew/status/1902671072044241057 · Twitter Post
• https://t.me/cveNotify/130151 · Telegram Post