Executive brief
LlamaIndex, a popular framework for connecting custom data to Large Language Models (LLMs), contains a vulnerability in how it handles database queries. An attacker could exploit this to read, modify, or delete sensitive information stored in the application's database. This could lead to unauthorized access to user data or a complete compromise of the data used by the AI application.
Technical details
Multiple vector store integrations in llama-index (before version 0.12.28) fail to properly neutralize special elements used in SQL commands, leading to a CWE-89 SQL Injection vulnerability. The root cause is the construction of SQL queries using externally-influenced input without sufficient sanitization or parameterized queries. A remote, unauthenticated attacker can exploit this by sending crafted input to an application using the library, enabling them to execute arbitrary SQL commands. This allows for unauthorized reading and writing of data within the underlying database. The vulnerability was addressed in version 0.12.28.
Affected products
- run-llama llama-index < 0.12.28
Timeline
- 2025-06-05: advisory: GitHub Advisory published
- 2025-06-05: disclosed: NVD publication date
- 2025-06-06: other: GitHub Advisory reviewed