netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-jmgm-gx32-vp4w
GHSA-x48g-hm9c-ww42
This commit is contained in:
advisory-database[bot]
2025-03-21 18:49:58 +00:00
parent a8396d31e3
commit b2f9fd60ab
2 changed files with 60 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/03/GHSA-jmgm-gx32-vp4w/GHSA-jmgm-gx32-vp4w.json → advisories/github-reviewed/2025/03/GHSA-jmgm-gx32-vp4w/GHSA-jmgm-gx32-vp4w.json
+30 -5
View File
@@ -1,19 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jmgm-gx32-vp4w",
"modified": "2025-03-20T12:32:44Z",
"modified": "2025-03-21T18:49:08Z",
"published": "2025-03-20T12:32:44Z",
"aliases": [
"CVE-2024-12911"
],
"details": "A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.5.1.",
"summary": "LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions",
"details": "A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.12.3.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "llama-index"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.12.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -23,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/run-llama/llama_index/commit/bf282074e20e7dafd5e2066137dcd4cd17c3fb9e"
},
{
"type": "PACKAGE",
"url": "https://github.com/run-llama/llama_index"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/095f9e67-311d-494c-99c5-5e61a0adb8f3"
@@ -33,8 +58,8 @@
"CWE-379"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T18:49:08Z",
"nvd_published_at": "2025-03-20T10:15:32Z"
}
}
advisories/unreviewed/2025/03/GHSA-x48g-hm9c-ww42/GHSA-x48g-hm9c-ww42.json → advisories/github-reviewed/2025/03/GHSA-x48g-hm9c-ww42/GHSA-x48g-hm9c-ww42.json
+30 -5
View File
@@ -1,19 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x48g-hm9c-ww42",
"modified": "2025-03-20T12:32:44Z",
"modified": "2025-03-21T18:48:32Z",
"published": "2025-03-20T12:32:44Z",
"aliases": [
"CVE-2024-12909"
],
"details": "A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL's large object functionality. The issue is fixed in version 0.3.0.",
"summary": "LlamaIndex SQL Injection vulnerability",
"details": "A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL's large object functionality. The issue is fixed in the `stale_packages` branch.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "llama-index"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.12.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -23,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/run-llama/llama_index/commit/5d03c175476452db9b8abcdb7d5767dd7b310a75"
},
{
"type": "PACKAGE",
"url": "https://github.com/run-llama/llama_index"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/44e8177f-200a-4ba3-a12c-8bc21e313a3f"
@@ -33,8 +58,8 @@
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T18:48:32Z",
"nvd_published_at": "2025-03-20T10:15:31Z"
}
}