llama_index v0.12.21 Vulnerable to SQL Injection: Early Warning
Multiple vector store integrations in run-llama/llama_index version v0.12.21 are reportedly vulnerable to SQL injection, potentially allowing unauthorized data access.
What happened
The GitHub Security Advisory GHSA-v3c8-3pr6-gr7p indicates that version v0.12.21 of the llama_index library contains SQL injection vulnerabilities. These vulnerabilities could allow an attacker to execute arbitrary SQL commands, leading to unauthorized data access or modification. The severity of the impact depends on how the llama_index library is used within a web application. It is under investigation whether any actual compromise has occurred. Users of this version should upgrade to the latest version of llama_index and review their application's SQL query usage to mitigate potential risks.
How 0Day mitigates this
llama-index is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.