CVE-2025-1750 — SQL Injection in run-llama/llama_index
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate …
Published: 2025-06-02 · CVSS: 9.8 · CVSS 3.0
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7