GitHub Advisoryadvisory · PyPI

GHSA-jmgm-gx32-vp4w LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions

HIGH Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-12911
Ecosystem
PyPI
Packages
llama-index
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Weaknesses
CWE-379, CWE-89
Reviewed
2025-03-21

Affected packages

• PyPI llama-index: < 0.12.3 → fixed in 0.12.3

Description

A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.12.3.

Related

Alias · CVE (1)

  • CVE-2024-12911 A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL… vulnerability

Weakness · CWE (2)

  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References