GHSA-2JXW-4HM4-6W87 SQL injection in llama-index

LlamaIndex aka llamaindex through 0.9.35 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro...

CVE-2024-23751

CVE-2024-23751 concerns LlamaIndex (llama_index) up to version 0.9.34, where the Text-to-SQL feature is vulnerable to SQL injection via multiple engines (NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine). The described impact is...