Executive brief
llmware is a framework for building enterprise AI pipelines with language models. Version 0.4.6 contains an SQL injection vulnerability in its database filtering layer that allows attackers to bypass intended access controls and retrieve data they should not have access to across documents and collections. On PostgreSQL systems, attackers could potentially execute arbitrary SQL commands.
Technical details
The vulnerability is a classic SQL injection flaw in llmware/resources.py where filter and lookup values are directly concatenated into SQL WHERE clauses without parameterization or escaping in both SQLite and PostgreSQL backends. The filter validator only checks dictionary keys against an allowlist but does not sanitize user-supplied values. Attacker-controlled input reaches the public API through Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker methods. On SQLite, attackers can neutralize filters to disclose unintended rows (cross-document/cross-collection data leakage); on PostgreSQL, boolean-based and UNION-based SQL injection are possible for full database manipulation. No authentication bypass is required if the application exposes these methods to untrusted input.
Affected products
- llmware llmware 0.4.6
Timeline
- 2026-09-04: disclosed