CVE-2024-11958
published 2025-03-20CVE-2024-11958: A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The…
PriorityP261critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
1.31%
67.1th percentile
A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. This can lead to remote code execution (RCE) by installing the shellfs extension and executing malicious commands.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| llamaindex | llamaindex | < 0.4.0 | 0.4.0 |
| run-llama | run-llama_llama_index | >= unspecified < 0.4.0 | 0.4.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection
osv·2025-03-20
CVE-2024-11958 [CRITICAL] LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection
LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection
A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in llama-index-retrievers-duckdb-retriever prior to v0.4.0. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. This can lead to remote code execution (RCE) by installing the shellfs extension and executing malicious commands.
GHSA
LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection
ghsa·2025-03-20
CVE-2024-11958 [CRITICAL] CWE-89 LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection
LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection
A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in llama-index-retrievers-duckdb-retriever prior to v0.4.0. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. This can lead to remote code execution (RCE) by installing the shellfs extension and executing malicious commands.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-03-20
Published