| Package | Affected versions | Patched versions |
|---|---|---|
| llama-index | < 0.12.3 | 0.12.3 |
| llamaindex | < 0.5.1 | 0.5.1 |
A vulnerability in the default_jsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.12.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free