CVE-2024-11958: falha crítica em run-llama/llama_index
SQL Injection in run-llama/llama_index
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 1.4%
A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. This can lead to remote code execution (RCE) by installing the shellfs extension and executing malicious commands.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
run-llama · run-llama/llama_indexCVEs relacionadas — run-llama/llama_index
No mesmo produto, das mais perigosas para as menos.
CVE-2024-3271CRITICALCommand Injection in run-llama/llama_indexEPSS 2.9%CVE-2024-4181HIGHCommand Injection in run-llama/llama_indexEPSS 2.1%CVE-2024-12909CRITICALSQL Injection to RCE in run-llama/llama_indexEPSS 1.4%CVE-2025-1753HIGHCommand Injection in LLama-Index CLI in run-llama/llama_indexEPSS 1.1%CVE-2024-3098CRITICALPrompt Injection leading to Arbitrary Code Execution in run-llama/llama_indexEPSS 1.0%CVE-2025-1750CRITICALSQL Injection in run-llama/llama_indexEPSS 0.9%