{"action":"Upgrade llama-index to 0.9.35 or later.","affected":[{"fixed":"0.9.35","introduced":"0"}],"component":"llama-index","cve_ids":["CVE-2024-23751"],"ecosystem":"PyPI","epss":0.00654,"exploited":false,"fixed_versions":["0.9.35"],"ghsa_id":"GHSA-2jxw-4hm4-6w87","id":"tcs_01M5KGKZ8YD1CXA0ZZQAKDKB93","modified_at":"2026-06-10T17:02:02.879353549Z","published_at":"2024-01-22T01:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2024-12","https://github.com/run-llama/llama_index/issues/9957","https://github.com/advisories/GHSA-2jxw-4hm4-6w87"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2024-12","url":"https://osv.dev/vulnerability/PYSEC-2024-12"}],"summary":"LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorS"}