Description

llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/resources.py) where filter and lookup values are directly string-interpolated into SQL WHERE clauses without parameterization or escaping, in both the SQLite and PostgreSQL backends. The filter validator only checks keys against an allow-list and never sanitizes values. Attacker-controlled filter values reaching the public API via Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker can neutralize the intended filter to disclose rows the caller was scoped out of (cross-document/cross-collection disclosure); on PostgreSQL the flaw permits boolean- and UNION-based SQL injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T15:17:46.803Z",
  "pubdate": "2026-09-04T15:17:46.803Z",
  "executiveSummary": "llmware version 0.4.6 is susceptible to a critical SQL injection vulnerability residing within its collection-database layer.\nThe flaw stems from the improper handling of user-supplied filter and lookup values, which are directly interpolated into SQL queries without sanitization or parameterized inputs.\nThis vulnerability affects both SQLite and PostgreSQL database backends, allowing unauthorized parties to manipulate query logic.\nThe primary security impact involves unauthorized cross-document and cross-collection data disclosure, effectively bypassing row-level access controls.\nIn PostgreSQL environments, the vulnerability is particularly severe, enabling boolean-based and UNION-based SQL injection attacks.\nAn attacker can exploit this via publicly exposed API endpoints, specifically through Library.block_lookup, Query.text_query_with_custom_filter, and text_query_by_author_or_speaker.\nSuccessful exploitation allows an attacker to exfiltrate sensitive information from the database that should otherwise be restricted based on the user's scope.",
  "technicalDetails": "The vulnerability is located in the llmware/resources.py file, which serves as the interface between the application logic and the underlying database engine.\nThe root cause is the failure to utilize parameterized queries (prepared statements). Instead, the application uses Python string interpolation to construct SQL WHERE clauses.\nWhile the library implements a filter validator, this component only validates dictionary keys against an allow-list; it entirely fails to sanitize the corresponding filter values.\nWhen a user invokes functions such as Library.block_lookup, Query.text_query_with_custom_filter, or text_query_by_author_or_speaker, the input values are passed directly into the SQL string generation process.\nBecause these values are not escaped, an attacker can supply specially crafted inputs containing SQL syntax characters (e.g., single quotes, comments, or UNION operators) to escape the intended context of the WHERE clause.\nIn a PostgreSQL environment, this allows for the injection of arbitrary SQL commands. An attacker can craft payloads that force the database to return records outside of the user's intended scope by manipulating the boolean logic of the WHERE clause or appending malicious queries using the UNION operator to join unauthorized data sets.\nThe exploitation flow begins when an attacker identifies the relevant API endpoints that accept filter dictionaries. By injecting malicious SQL fragments into the 'value' field of the filter dictionary, the attacker can hijack the query execution flow. For example, a filter intended to retrieve records where 'author'='target' could be transformed into 'author'='target' OR 1=1-- to disclose all records in the collection.\nThe vulnerability requires no special privileges or authentication if the affected API endpoints are exposed publicly. The scope of impact is total for the databases managed by the affected llmware instance, potentially leading to a complete compromise of the data stored within the collections."
}