Vendor
run-llama
26 known vulnerabilities.
Products
6 results · Clear filters · Feed
-
Critical 9.8
SQL Injection in run-llama/llama_index
Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depend…
-
Critical 9.8
SQL Injection in run-llama/llama_index
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the s…
-
Critical 9.8
SQL Injection in run-llama/llama_index
A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an …
-
Critical 10.0
SQL Injection to RCE in run-llama/llama_index
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitra…
-
Critical 9.8
Command Injection in run-llama/llama_index
A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execu…
-
Critical 9.8
Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index
A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, …