{"id":"CVE-2024-12911","aliases":["GHSA-jmgm-gx32-vp4w","PYSEC-2026-1555"],"title":"LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions","summary":"LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","vendor":"llama-index","product":"llama-index","ecosystem":"pip","affected":["llama-index < 0.12.3"],"patched":["llama-index 0.12.3"],"published":"2025-03-20","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-jmgm-gx32-vp4w","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12911"},{"url":"https://github.com/run-llama/llama_index/commit/bf282074e20e7dafd5e2066137dcd4cd17c3fb9e"},{"url":"https://github.com/run-llama/llama_index"},{"url":"https://huntr.com/bounties/095f9e67-311d-494c-99c5-5e61a0adb8f3"}],"tags":["osv","pip"],"epss":0.00512,"epssPercentile":0.42481,"ingestedAt":"2026-07-08T18:25:50.839Z","slug":"CVE-2024-12911","body":"## Overview\n\nA vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.12.3.\n\n## Affected packages\n\n- `llama-index < 0.12.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `llama-index 0.12.3`","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}