Vulnerability	Vulnerable Version
M SQL Injection griptape-tools is a Tools for the Griptape framework. Affected versions of this package are vulnerable to SQL Injection through the `execute_query` path in the SQL tool and loader components. An attacker can execute malicious SQL against the connected database by prompt-injecting the LLM to supply unsafe `sql_query` input. In affected deployments, this can lead to remote code execution on databases that support command execution features such as PostgreSQL `COPY ... FROM PROGRAM`, as well as arbitrary file read/write, data exfiltration, or denial of service through destructive or resource-intensive queries. How to fix SQL Injection? There is no fixed version for `griptape-tools`.	[0.5.0,)

SQL Injection

griptape-tools is a Tools for the Griptape framework.

Affected versions of this package are vulnerable to SQL Injection through the execute_query path in the SQL tool and loader components. An attacker can execute malicious SQL against the connected database by prompt-injecting the LLM to supply unsafe sql_query input. In affected deployments, this can lead to remote code execution on databases that support command execution features such as PostgreSQL COPY ... FROM PROGRAM, as well as arbitrary file read/write, data exfiltration, or denial of service through destructive or resource-intensive queries.

How to fix SQL Injection?

There is no fixed version for griptape-tools.

[0.5.0,)

Go back to all versions of this package