CVE-2025-1750
02.06.2025, 10:15
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).
| Vendor | Product | Version |
|---|---|---|
| llamaindex | llamaindex | 0.12.19 ≤ 𝑥 < 0.12.21 |
𝑥
= Vulnerable software versions