CVE-2024-12909 is a critical (CVSS 9.8) SQL injection in the FinanceChatLlamaPack of run-llama/llama_index, in the run_sql_query function of the database_agent. The record says it can lead to remote code execution through PostgreSQL large objects, and names version 0.3.0 as the fix. Check your pack version.
What's affected
- run-llama/llama_index, FinanceChatLlamaPack, versions up to v0.12.3 as written in the record.
- The flaw sits in run_sql_query within the database_agent.
The record states the issue is fixed in version 0.3.0. The version numbers in the record do not line up in an obvious way (0.12.3 is higher than 0.3.0), so read the linked commit and the project's release notes to see which package version you need.
How to check if you're exposed
Run the check below, or read the vendor or project notes linked in Sources.
pip list | grep -i llama
grep -ri llama requirements.txt
Compare the result to the affected range above.
What to do now
- Find every project that installs the finance chat pack, including notebooks and demo apps.
- Read the linked commit to see how the query path changed, then upgrade the relevant package.
- Run the database agent with a read-only database role that cannot create large objects or call administrative functions.
- Do not connect agent generated SQL to a production database with broad privileges.
- Look up CVE-2024-12909 on its Gold page to see the current details and any fix information.
- Check your own dependency files with the free in-browser dependency scan. It runs in your browser and does not send the file to a server.
Why it matters
An agent that turns a chat message into SQL is only as safe as the way it passes that SQL to the database. The record describes classic SQL injection: attacker influenced text ends up inside a query that runs with the application's database rights. It then notes that PostgreSQL's large object functions can turn that foothold into code execution on the database host.
This is a good example of why least privilege matters for AI agents. A database account that can only read three views limits what any injected statement can do, no matter how clever the prompt is. The same logic applies to any tool you hand to a language model.
This CVE is an SQL injection flaw (CWE-89, SQL Injection). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
SQL injection happens when user input is placed into a database query as if it were part of the query itself. The database cannot tell which parts were written by the developer and which were supplied by a visitor, so it runs both.
The standard cure is prepared statements with bound parameters, plus escaping and validation as a second layer. The record points at missing escaping and missing query preparation, which is the usual pattern. Here the confidentiality impact is high and integrity and availability are not affected in the CVSS vector, so the main concern is data leaving the database: user records, order data and stored secrets.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why does a chat tool lead to RCE?
The record says SQL injection can be escalated through PostgreSQL's large object functionality. The agent runs queries with whatever rights its database user has.
What is the best containment?
Give the agent a database role with minimal rights, so injected SQL cannot reach administrative functions.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
