https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 21:59:32 +0000 https://cve.radiocsirt.org/vuln/cve-2024-12909 <p><strong>Affected:</strong> run-llama/llama_index</p> <p>A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL&#39;s large object functionality. The issue is fixed in version 0.3.0.</p> <p><strong>Affected:</strong> run-llama/llama_index</p> <p>A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL&#39;s large object functionality. The issue is fixed in version 0.3.0.</p> https://cve.radiocsirt.org/vuln/cve-2024-12909 https://cve.radiocsirt.org/vuln/ghsa-x48g-hm9c-ww42 <p><strong>Affected:</strong> PyPI: llama-index-packs-finchat</p> <p>A vulnerability in the FinanceChatLlamaPack of the llama-index-packs-finchat package, versions up to v0.3.0, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL&#39;s large object functionality.</p> <p>The issue is resolved by no longer officially supporting the package and moving it into the `stale_packages` branch on the repo, this removing it from documentation etc.</p> <p><strong>Affected:</strong> PyPI: llama-index-packs-finchat</p> <p>A vulnerability in the FinanceChatLlamaPack of the llama-index-packs-finchat package, versions up to v0.3.0, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code execution (RCE) through the use of PostgreSQL&#39;s large object functionality.</p> <p>The issue is resolved by no longer officially supporting the package and moving it into the `stale_packages` branch on the repo, this removing it from documentation etc.</p> https://cve.radiocsirt.org/vuln/ghsa-x48g-hm9c-ww42