Disclosed vulnerability
CVE-2024-12911: prompt injection to SQL injection to arbitrary file creation in LlamaIndex JSONalyzeQueryEngine
AIR-2025-0016 AIR record · 2025-03-llamaindex-jsonalyze-sql-injection
From the supporting source
A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks.github.com
The record
Disclosed
2025-03-20
Vendor
LlamaIndex (run-llama)
Product
LlamaIndex (llama-index / llama-index-core)
Risk domain
Tool misuse › Uncontrolled resource consumption
System type
Generative model
Who acted
Agent acted — the engine generated and executed SQL that wrote files
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Prompt injection into generated sql
Impact type
Arbitrary file write, Denial of service
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0029 – Denial of ML Service
- NIST AI RMF
- MAP 3.2
- EU AI Act
- —
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- D. Reliability
- Scope
- tool failure
- Mitigation
- Impose rate limits, timeouts, and resource quotas on agent actions.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
applications using JSONalyzeQueryEngine in llama-index < 0.12.3
Capability abused
Defense & remediation
Recorded defense
none - LLM-generated SQL executed directly against a local sqlite instance
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
llama-index 0.12.3
Taxonomy & references
Curator notes
GHSA-jmgm-gx32-vp4w, CVSS 7.1 High, CWE-379. Reported via huntr. Exploitation runs ATTACH DATABASE to create files on the filesystem. Canonical example of an LLM-generated-query surface in an agent framework.
Supporting sources
Cite as
Enkrypt AI. "CVE-2024-12911: prompt injection to SQL injection to arbitrary file creation in LlamaIndex JSONalyzeQueryEngine". AIR, AIR-2025-0016. https://agentincident.vercel.app/i/AIR-2025-0016/ (accessed 2026-10-19).