{"action":"Upgrade llama-index-retrievers-duckdb-retriever to 0.4.0 or later.","affected":[{"fixed":"0.4.0","introduced":"0"}],"component":"llama-index-retrievers-duckdb-retriever","cve_ids":["CVE-2024-11958"],"ecosystem":"PyPI","epss":0.01444,"exploited":false,"fixed_versions":["0.4.0"],"ghsa_id":"GHSA-339r-cjv9-x78g","id":"tcs_01M5KH93YRKSKDAJT6B3MK7D7Y","modified_at":"2026-07-01T20:22:56.508105Z","published_at":"2026-06-29T11:50:35.232967Z","references":["https://osv.dev/vulnerability/PYSEC-2026-399","https://nvd.nist.gov/vuln/detail/CVE-2024-11958","https://github.com/run-llama/llama_index/commit/35bd221e948e40458052d30c6ef2779bc965b6d0","https://github.com/run-llama/llama_index","https://huntr.com/bounties/8ddf66e1-f74c-4d53-992b-76bc45cacac1","https://pypi.org/project/llama-index-retrievers-duckdb-retriever","https://github.com/advisories/GHSA-339r-cjv9-x78g"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-399","url":"https://osv.dev/vulnerability/PYSEC-2026-399"}],"summary":"LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection"}