Security advisory GHSA-jmgm-gx32-vp4w: LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
Package: llama-index (pypi), vulnerable version: 0.12.2, fixed in: 0.12.3
CWE: CWE-379
CWE-89
Files changed by the fix:
llama-index-core/llama_index/core/query_engine/__init__.py
llama-index-core/llama_index/core/query_engine/jsonalyze/__init__.py
llama-index-core/llama_index/core/query_engine/jsonalyze/jsonalyze_query_engine.py
llama-index-experimental/llama_index/experimental/query_engine/jsonalyze/__init__.py
llama-index-experimental/llama_index/experimental/query_engine/jsonalyze/jsonalyze_query_engine.py

Fix diff:
diff --git a/llama-index-core/llama_index/core/query_engine/__init__.py b/llama-index-core/llama_index/core/query_engine/__init__.py
index b83eadc001a..b9234160003 100644
--- a/llama-index-core/llama_index/core/query_engine/__init__.py
+++ b/llama-index-core/llama_index/core/query_engine/__init__.py
@@ -15,7 +15,7 @@
 from llama_index.core.query_engine.graph_query_engine import (
     ComposableGraphQueryEngine,
 )
-from llama_index.core.query_engine.jsonalyze_query_engine import (
+from llama_index.core.query_engine.jsonalyze import (
     JSONalyzeQueryEngine,
 )
 from llama_index.core.query_engine.knowledge_graph_query_engine import (
diff --git a/llama-index-core/llama_index/core/query_engine/jsonalyze/BUILD b/llama-index-core/llama_index/core/query_engine/jsonalyze/BUILD
new file mode 100644
index 00000000000..db46e8d6c97
--- /dev/null
+++ b/llama-index-core/llama_index/core/query_engine/jsonalyze/BUILD
@@ -0,0 +1 @@
+python_sources()
diff --git a/llama-index-core/llama_index/core/query_engine/jsonalyze/__init__.py b/llama-index-core/llama_index/core/query_engine/jsonalyze/__init__.py
new file mode 100644
index 00000000000..621679a1e43
--- /dev/null
+++ b/llama-index-core/llama_index/core/query_engine/jsonalyze/__init__.py
@@ -0,0 +1,7 @@
+"""Init file."""
+
+from llama_index.core.query_engine.jsonalyze.jsonalyze_query_engine import (
+    JSONalyzeQueryEngine,
+)
+
+__all__ = ["JSONalyzeQueryEngine"]
diff --git a/llama-index-core/llama_index/core/query_engine/jsonalyze/jsonalyze_query_engine.py b/llama-index-core/llama_index/core/query_engine/jsonalyze/jsonalyze_query_engine.py
new file mode 100644
index 00000000000..93daae7a6c0
--- /dev/null
+++ b/llama-index-core/llama_index/core/query_engine/jsonalyze/jsonalyze_query_engine.py
@@ -0,0 +1,28 @@
+"""JSONalyze Query Engine.
+
+WARNING: This tool executes a SQL prompt generated by the LLM with SQL Lite and
+may lead to arbitrary file creation on the machine running this tool.
+This tool is not recommended to be used in a production setting, and would
+require heavy sandboxing or virtual machines.
+
+DEPRECATED: Use `JSONalyzeQueryEngine` from `llama-index-experimental` instead.
+
+"""
+
+from typing import Any
+
+
+class JSONalyzeQueryEngine:
+    """JSONalyze query engine.
+
+    DEPRECATED: Use `JSONalyzeQueryEngine` from `llama-index-experimental` instead.
+    """
+
+    def __init__(self, *args: Any, **kwargs: Any) -> None:
+        raise DeprecationWarning(
+            "JSONalyzeQueryEngine has been moved to `llama-index-experimental`.\n"
+            "`pip install llama-index-experimental`\n"
+            "`from llama_index.experimental.query_engine import JSONalyzeQueryEngine`\n"
+            "Note that the JSONalyzeQueryEngine allows for arbitrary file creation, \n"
+            "and should be used in a secure environment."
+        )
diff --git a/llama-index-experimental/llama_index/experimental/query_engine/jsonalyze/BUILD b/llama-index-experimental/llama_index/experimental/query_engine/jsonalyze/BUILD
new file mode 100644
index 00000000000..db46e8d6c97
--- /dev/null
+++ b/llama-index-experimental/llama_index/experimental/query_engine/jsonalyze/BUILD
@@ -0,0 +1 @@
+python_sources()
diff --git a/llama-index-experimental/llama_index/experimental/query_engine/jsonalyze/__init__.py b/llama-index-experimental/llama_index/experimental/query_engine/jsonalyze/__init__.py
new file mode 100644
index 00000000000..621679a1e43
--- /dev/null
+++ b/llama-index-experimental/llama_index/experimental/query_engine/jsonalyze/__init__.py
@@ -0,0 +1,7 @@
+"""Init file."""
+
+from llama_index.core.query_engine.jsonalyze.jsonalyze_query_engine import (
+    JSONalyzeQueryEngine,
+)
+
+__all__ = ["JSONalyzeQueryEngine"]
diff --git a/llama-index-core/llama_index/core/query_engine/jsonalyze_query_engine.py b/llama-index-experimental/llama_index/experimental/query_engine/jsonalyze/jsonalyze_query_engine.py
similarity index 97%
rename from llama-index-core/llama_index/core/query_engine/jsonalyze_query_engine.py
rename to llama-index-experimental/llama_index/experimental/query_engine/jsonalyze/jsonalyze_query_engine.py
index c3aa2c92973..9a6e29e0aa5 100644
--- a/llama-index-core/llama_index/core/query_engine/jsonalyze_query_engine.py
+++ b/llama-index-experimental/llama_index/experimental/query_engine/jsonalyze/jsonalyze_query_engine.py
@@ -1,3 +1,14 @@
+"""JSONalyze Query Engine.
+
+WARNING: This tool executes a SQL prompt generated by the LLM with SQL Lite and
+may lead to arbitrary file creation on the machine running this tool.
+This tool is not recommended to be used in a production setting, and would
+require heavy sandboxing or virtual machines.
+
+DEPRECATED: Use `JSONalyzeQueryEngine` from `llama-index-experimental` instead.
+
+"""
+
 import asyncio
 import json
 import logging
diff --git a/llama-index-experimental/pyproject.toml b/llama-index-experimental/pyproject.toml
index 338c1ecbab0..ec344cfe73f 100644
--- a/llama-index-experimental/pyproject.toml
+++ b/llama-index-experimental/pyproject.toml
@@ -25,7 +25,7 @@ exclude = ["**/BUILD"]
 license = "MIT"
 name = "llama-index-experimental"
 readme = "README.md"
-version = "0.5.0"
+version = "0.5.1"
 
 [tool.poetry.dependencies]
 python = ">=3.10,<4.0"