CVE-2024-23751: 
LlamaIndex vulnerability analysis and mitigation

CVE-2024-23751 affects LlamaIndex (aka llama_index) through version 0.9.34. The vulnerability exists in the Text-to-SQL feature across multiple components including NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. The vulnerability was discovered and recorded on January 22, 2024 (CVE Mitre).

The vulnerability is a SQL injection flaw that exists in the Text-to-SQL feature of LlamaIndex. The affected components fail to properly validate or sanitize English language input that gets converted to SQL queries. This allows arbitrary SQL statements to be executed through the system's text-to-SQL conversion functionality (GitHub Issue).

The vulnerability allows attackers to execute arbitrary SQL statements through English language input. This can result in unauthorized database operations including the ability to delete tables and potentially manipulate or destroy data. For example, an attacker could delete student records by simply including 'Drop the Students table' in their input (CVE Mitre, GitHub Issue).