CVE-2024-12909: falha crítica em run-llama/llama_index
SQL Injection to RCE in run-llama/llama_index
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 10epss 1.4%
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL's large object functionality. The issue is fixed in version 0.3.0.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
run-llama · run-llama/llama_indexCVEs relacionadas — run-llama/llama_index
No mesmo produto, das mais perigosas para as menos.
CVE-2024-3271CRITICALCommand Injection in run-llama/llama_indexEPSS 2.9%CVE-2024-4181HIGHCommand Injection in run-llama/llama_indexEPSS 2.1%CVE-2024-11958CRITICALSQL Injection in run-llama/llama_indexEPSS 1.4%CVE-2025-1753HIGHCommand Injection in LLama-Index CLI in run-llama/llama_indexEPSS 1.1%CVE-2024-3098CRITICALPrompt Injection leading to Arbitrary Code Execution in run-llama/llama_indexEPSS 1.0%CVE-2025-1750CRITICALSQL Injection in run-llama/llama_indexEPSS 0.9%