Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2024-23751
9.8
CRITICALCVSS v3
Published
January 22, 2024
Affected
1 project
Assigned by
MITRE
Severity scale
010
Description
LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Drop the Students table" within English language input.
run-llama/llama_index
GitHubLlamaIndex is the leading document agent and OCR platform
GitHubLlamaIndex is the leading document agent and OCR platform<= 0.9.34, <= 0.9.35, < 0.9.35NVD