CVE-2024-23751

What it actually does

The flaw permits unauthenticated remote attackers to supply natural-language prompts that are translated into executable SQL statements without sanitization or parameterization inside the listed Text-to-SQL engines, resulting in arbitrary SQL execution against the connected database.

Why it matters to the business

Applications that expose natural-language database access through this library risk complete database compromise, data theft or destruction, regulatory penalties, and operational disruption; the library's widespread use in AI-driven data tools increases exposure across many organizations.

How an attack unfolds

An attacker interacts with an application that forwards user text to one of the vulnerable query engines; the supplied English sentence is converted into raw SQL and executed, allowing the attacker to issue destructive commands such as dropping tables or extracting records.

How to fix it

Upgrade LlamaIndex to the newest release after 0.9.34; until then disable or restrict the affected query engines, enforce strict input validation and output parameterization, and place the database behind least-privilege accounts.

How to confirm the fix worked

Inventory all uses of NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine; run the engine with test prompts containing SQL keywords and inspect generated queries and database logs for unsanitized execution.

Typical attack path

1. Locate an application or service exposing LlamaIndex Text-to-SQL query engines
2. Submit crafted natural-language input containing SQL syntax (for example, 'Drop the Students table')
3. Observe the engine translating the input into executable SQL and running it against the backend database
4. Escalate to data exfiltration, modification, or denial of service via additional injected statements

How to detect it

Search application and database logs for natural-language queries that contain SQL verbs (DROP, DELETE, SELECT, UNION) or table names not expected in normal use; review process execution history for the listed engine classes receiving untrusted input.

• Drop the Students table
• NLSQLTableQueryEngine
• SQLTableRetrieverQueryEngine
• PGVectorSQLQueryEngine

What your security team should do

• Immediately audit codebases and dependency trees for llamaindex versions <= 0.9.34
• Prioritize upgrade or feature disablement for any internet-facing or high-value database integrations
• Add web-application firewall rules that block natural-language inputs containing SQL keywords
• Enable detailed logging of all Text-to-SQL translations and correlate with database audit trails