llmware 0.4.6 is vulnerable to SQL injection in the collection‑database layer where unescaped filter values are directly interpolated into SQL WHERE clauses for both SQLite and PostgreSQL backends. The flaw arises because the filter validator only checks allowed keys, never sanitizing or parameterizing values. As a result, attackers can craft malicious filter inputs through the public API endpoints Library.block_lookup and Query.text_query_with_custom_filter / text_query_by_author_or_speaker. The impact includes unintended disclosure of rows the caller was scoped out of, cross‑document and cross‑collection data leakage, and on PostgreSQL additional Boolean and UNION‑based injection that could allow arbitrary data extraction or structural changes.

The affected product is llmware‑ai’s llmware application, version 0.4.6. Both SQLite and PostgreSQL database backends are impacted because the vulnerability resides in llmware/resources.py which builds raw SQL queries regardless of backend.

The CVSS score is 7.1, reflecting a high‑severity vulnerability. EPSS is not available, so current exploit probability cannot be quantified, and the CVE is not listed in CISA KEV. Attackers would need to send specially crafted filter values to the public API, which is likely reachable over the network; no local privileges are required beyond API access. Because the flaw allows direct string interpolation, exploitation is straightforward when the attacker can influence the filter values, making the risk significant for exposed deployments.