CVE-2024-11958

critical · 9.8

A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. This can lead to remote code execution (RCE) by installing the shellfs extension and executing malicious commands.

9.8

CVSS

1.4%

EPSS (exploit prob.)

72nd

EPSS percentile

2025-03-20

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
llamaindex	llamaindex	< 0.4.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/run-llama/llama_index/commit/35bd221e948e40458052d30c6ef2779bc965b6d0
https://huntr.com/bounties/8ddf66e1-f74c-4d53-992b-76bc45cacac1

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-11958