{"data":{"id":"ad8a95b4-5383-49ec-882f-d0b17e8e8e1a","title":"CVE-2024-12911: A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index…","summary":"CVE-2024-12911 is a vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository. It allows SQL injection via prompt injection, which can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.5.1.","solution":"Fixed in version 0.5.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-12911","publishedAt":"2025-03-20T10:15:32.083Z","cveId":"CVE-2024-12911","cweIds":["CWE-89"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["llama-index@< 0.12.3 (fixed: 0.12.3)"],"affectedPackageNames":["llama-index"],"affectedPackageRefs":["pypi:llama-index"],"affectedVendors":["LlamaIndex"],"affectedVendorsRaw":["LlamaIndex","JSONalyzeQueryEngine"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"llama_index SQL injection via prompt injection in JSONalyzeQueryEngine","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00522,"epssCheckedAt":"2026-11-04T12:08:35.127Z","kevDateAdded":null,"advisoryAliases":["GHSA-jmgm-gx32-vp4w"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:25.579Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-12-06T04:40:32.193Z","daysToFix":-104,"fixCheckedAt":"2026-10-29T21:45:00.853Z","capecIds":["CAPEC-66"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"pypi","name":"llama-index","fixedVersion":"0.12.3","matchedVersion":"0.12.3","fixReleasedAt":"2024-12-06T04:40:32.193Z","daysToFix":-104,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:00.703Z"}]}}