netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-x48g-hm9c-ww42

Browse Source
This commit is contained in:
advisory-database[bot]
2025-04-03 13:13:42 +00:00
parent 7d52feec77
commit 03024e8330
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/03/GHSA-x48g-hm9c-ww42/GHSA-x48g-hm9c-ww42.json
+9 -5
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x48g-hm9c-ww42",
"modified": "2025-03-21T18:48:32Z",
"modified": "2025-04-03T13:11:41Z",
"published": "2025-03-20T12:32:44Z",
"aliases": [
"CVE-2024-12909"
],
"summary": "LlamaIndex SQL Injection vulnerability",
"details": "A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL's large object functionality. The issue is fixed in the `stale_packages` branch.",
"summary": "llama-index-packs-finchat SQL Injection vulnerability",
"details": "A vulnerability in the FinanceChatLlamaPack of the llama-index-packs-finchat package, versions up to v0.3.0, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL's large object functionality.\n\nThe issue is resolved by no longer officially supporting the package and moving it into the `stale_packages` branch on the repo, this removing it from documentation etc.",
"severity": [
{
"type": "CVSS_V3",
@@ -18,7 +18,7 @@
{
"package": {
"ecosystem": "PyPI",
"name": "llama-index"
"name": "llama-index-packs-finchat"
},
"ranges": [
{
@@ -28,7 +28,7 @@
"introduced": "0"
},
{
"last_affected": "0.12.3"
"last_affected": "0.3.0"
}
]
}
@@ -48,6 +48,10 @@
"type": "PACKAGE",
"url": "https://github.com/run-llama/llama_index"
},
{
"type": "WEB",
"url": "https://github.com/run-llama/llama_index/tree/stale_packages/llama-index-packs/llama-index-packs-finchat"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/44e8177f-200a-4ba3-a12c-8bc21e313a3f"