{"action":"Upgrade llama-index-retrievers-duckdb-retriever to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0"}],"component":"llama-index-retrievers-duckdb-retriever","cve_ids":["CVE-2024-11958"],"ecosystem":"PyPI","epss":0.01444,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-339r-cjv9-x78g","id":"tcs_01M5KETPKGSPP2S03RNQN5ZKG6","modified_at":"2026-07-21T15:15:51.607956549Z","published_at":"2025-03-20T12:32:42Z","references":["https://osv.dev/vulnerability/GHSA-339r-cjv9-x78g","https://nvd.nist.gov/vuln/detail/CVE-2024-11958","https://github.com/run-llama/llama_index/commit/35bd221e948e40458052d30c6ef2779bc965b6d0","https://github.com/advisories/GHSA-339r-cjv9-x78g","https://github.com/pypa/advisory-database/tree/main/vulns/llama-index-retrievers-duckdb-retriever/PYSEC-2026-399.yaml","https://github.com/run-llama/llama_index","https://huntr.com/bounties/8ddf66e1-f74c-4d53-992b-76bc45cacac1","https://pypi.org/project/llama-index-retrievers-duckdb-retriever"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-339r-cjv9-x78g","url":"https://osv.dev/vulnerability/GHSA-339r-cjv9-x78g"}],"summary":"LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection"}