---
id: CVE-2024-12911
aliases:
  - GHSA-jmgm-gx32-vp4w
  - PYSEC-2026-1555
title: >-
  LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure
  Permissions
summary: >-
  LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure
  Permissions
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
vendor: llama-index
product: llama-index
ecosystem: pip
affected:
  - llama-index < 0.12.3
patched:
  - llama-index 0.12.3
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-jmgm-gx32-vp4w'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-12911'
  - url: >-
      https://github.com/run-llama/llama_index/commit/bf282074e20e7dafd5e2066137dcd4cd17c3fb9e
  - url: 'https://github.com/run-llama/llama_index'
  - url: 'https://huntr.com/bounties/095f9e67-311d-494c-99c5-5e61a0adb8f3'
tags:
  - osv
  - pip
epss: 0.00512
epssPercentile: 0.42661
ingestedAt: '2026-07-08T18:25:50.839Z'
---

## Overview

A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.12.3.

## Affected packages

- `llama-index < 0.12.3`

## Remediation

Upgrade to a patched release:

- `llama-index 0.12.3`