SQL Injection in run-llama/llama_index

The impact of this SQL injection vulnerability is severe. Successful exploitation allows an attacker to bypass intended access controls and directly interact with the underlying file system. By crafting malicious SQL queries through the refdocid parameter, an attacker can read sensitive configuration files, source code, or even upload and execute arbitrary code. This could lead to complete compromise of the server, including data exfiltration, denial of service, and remote code execution. The ability to write arbitrary files significantly expands the attack surface beyond simple data retrieval.

Applications utilizing LlamaIndex for document indexing and retrieval, particularly those deployed in production environments, are at risk. Organizations relying on LlamaIndex for sensitive data processing or integration with critical systems should prioritize patching. Shared hosting environments where LlamaIndex is installed alongside other applications are also at increased risk due to potential cross-contamination.

• python / application:

import os
import subprocess

def check_llama_index_version():
    try:
        result = subprocess.check_output(['pip', 'show', 'llama_index'], stderr=subprocess.STDOUT, text=True)
        for line in result.splitlines():
            if line.startswith('Version:'):
                version = line.split(':')[1].strip()
                if version <= '0.3.1':
                    return True
                else:
                    return False
    except FileNotFoundError:
        return False

if check_llama_index_version():
    print("LlamaIndex version is vulnerable. Upgrade to 0.3.1 or later.")
else:
    print("LlamaIndex version is not vulnerable.")

• generic web: Monitor application logs for SQL errors or unusual database queries involving the refdocid parameter. Look for attempts to read or write files outside of expected directories.

1. 2025-06-02Disclosure

   disclosure

1. Réservé2025-02-27
2. Publiée2025-06-02
3. EPSS mis à jour2026-03-23

The primary mitigation is to immediately upgrade LlamaIndex to version 0.3.1 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing input validation on the refdocid parameter to prevent SQL injection attempts. This could involve whitelisting allowed characters or using parameterized queries. Additionally, restrict file system access permissions for the LlamaIndex process to minimize the potential damage from a successful exploit. Monitor application logs for unusual database activity or file system modifications.