Executive brief
LlamaIndex, a popular framework for building AI applications, contains a vulnerability in its VannaQueryEngine component. This component is responsible for translating natural language prompts into SQL database queries. An attacker can provide a specially crafted prompt that generates extremely complex or resource-intensive database queries, potentially crashing the application or the underlying database and causing a service outage.
Technical details
An uncontrolled resource consumption vulnerability exists in LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 within the VannaPack VannaQueryEngine implementation. The root cause is located in the custom_query() logic in llama_index/packs/vanna/base.py, which generates SQL statements from user-supplied prompts and executes them via vn.run_sql() without enforcing execution limits or timeouts. A remote, unauthenticated attacker can exploit this by providing prompts that result in unbounded or computationally expensive SQL queries. This can lead to CPU and memory exhaustion on the database or application server, resulting in a denial-of-service (DoS) condition. Users are advised to upgrade to a version beyond 0.12.2 or implement strict query limits and input validation.
Affected products
- run-llama LlamaIndex <= 0.12.2
Timeline
- 2026-01-12: advisory: Initial disclosure by VulnCheck
- 2026-01-12: disclosed: CVE-2024-58339 published