CVE-2024-11958 - CVE House
Back to Database
Status published Critical CVE-2024-11958

SQL Injection in run-llama/llama_index

Vulnerability Description

A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. This can lead to remote code execution (RCE) by installing the shellfs extension and executing malicious commands.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-11958

Credits & Attribution

No credits recorded in the NVD database.

References

More from run-llama

View All →
CVE-2025-7707
World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index
High 7.1
CVE-2025-7647
Insecure Temporary File Handling in run-llama/llama_index
High 7.3
CVE-2025-6211
MD5 Hash Collision in run-llama/llama_index
Medium 6.5
CVE-2025-6210
Hardlink-Based Path Traversal in run-llama/llama_index
Medium 6.2
CVE-2025-6209
Arbitrary File Read through Path Traversal in run-llama/llama_index
High 7.5

Affected Vendor

Affected Software

run-llama/llama_index
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact