Описание
A vulnerability in the default_jsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.5.1.
Ссылки
- Patch
- ExploitThird Party Advisory
Уязвимые конфигурации
EPSS
7.1 High
CVSS3
Дефекты
Связанные уязвимости
A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.5.1.
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
EPSS
7.1 High
CVSS3