CyberRota Analysis
AI-GeneratedThe vulnerability exists in llmware 0.4.6, where SQL injection can occur due to unparameterized string interpolation of filter and lookup values in SQL queries. This flaw allows attackers to manipulate API calls to access unauthorized data, potentially leading to cross-document and cross-collection disclosure, and in PostgreSQL, it enables more severe SQL injection techniques. Organizations using llmware should prioritize patching this vulnerability to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/resources.py) where filter and lookup values are directly string-interpolated into SQL WHERE clauses without parameterization or escaping, in both the SQLite and PostgreSQL backends. The filter validator only checks keys against an allow-list and never sanitizes values. Attacker-controlled filter values reaching the public API via Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker can neutralize the intended filter to disclose rows the caller was scoped out of (cross-document/cross-collection disclosure); on PostgreSQL the flaw permits boolean- and UNION-based SQL injection.