LLMMedium
CVE-2024-12911: A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/…
- Occurred
- Mar 20, 2025
- Published
- Mar 20, 2025
- Source
- NVD CVE
Summary
A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.5.1.
Tags
- CVE
- CVE-2024-12911
- cvss:HIGH
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: LLM vulnerability allowing SQL injection via prompt injection in a language model library.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8